The IIO buffer is dereference to NULL when user space application
trying to change the parameters of iio buffer while driver pushing data
to iio buffer. The issue is solved by using proper initialization of
iio buffer and using standard api to push the data to iio buffer so that
driver will do proper conditon checking before changing the
parameters of buffer and before pushing the data.

Change-Id: I6c9b015fc2915c0d6f635e488305290a36eb9221
Signed-off-by: Puneet Yatnal <[email protected]>

Adding code changes to validate buffer size.
While calling ipa_read verifying the kernel buffer
size in range or not.

Change-Id: Idc608c2cf0587a00f19ece38a4eb646f7fde68e3
Signed-off-by: Praveen Kurapati <[email protected]>

Disable APC CPR under 10 degC and re-enable it at 15degC.
This is for device stability at cold temperature.

Change-Id: I6c9b015fc2915c0d6f635e488305290a36eb9222
Signed-off-by: Anirudh Ghayal <[email protected]>

Currently we are not validating read and write index of
tx and rx fifo's before calculating ptr, this can lead to
out-of-bound access. The patch adds proper check for the same.

Change-Id: I7b158e94ae743a90ac364783fe31914ca0fa582b
Signed-off-by: Hardik Arya <[email protected]>

We call arm64_apply_bp_hardening() from post_ttbr_update_workaround,
which has the unexpected consequence of being triggered on every
exception return to userspace when ARM64_SW_TTBR0_PAN is selected,
even if no context switch actually occured.

This is a bit suboptimal, and it would be more logical to only
invalidate the branch predictor when we actually switch to
a different mm.

In order to solve this, move the call to arm64_apply_bp_hardening()
into check_and_switch_context(), where we're guaranteed to pick
a different mm context.

Change-Id: I28f2fb09b77544e5ead095e9dad1ad64b2b3ae36
Acked-by: Will Deacon <[email protected]>
Signed-off-by: Marc Zyngier <[email protected]>
Signed-off-by: Catalin Marinas <[email protected]>
Git-commit: a8e4c0a919ae310944ed2c9ace11cf3ccd8a609b
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Srinivas Ramana <[email protected]>
Signed-off-by: Swetha Chikkaboraiah <[email protected]>

Doing a cat on pte,test_virt_addr from adb shell prints a null
character as well which is at the end of the string this is not
required so, don't pass this null character to copy_to_user.

Change-Id: I8d9120f64d1df84a704379eb00bd239fc7059e9e
Signed-off-by: Vijayanand Jitta <[email protected]>
Signed-off-by: Srinivasarao P <[email protected]>

Changes in 3.18.135: (108 commits)
        staging: iio: adc: ad7280a: handle error from __ad7280_read32()
        ARM: 8808/1: kexec:offline panic_smp_self_stop CPU
        dlm: Don't swamp the CPU with callbacks queued during recovery
        x86/PCI: Fix Broadcom CNB20LE unintended sign extension (redux)
        powerpc/pseries: add of_node_put() in dlpar_detach_node()
        serial: fsl_lpuart: clear parity enable bit when disable parity
        staging:iio:ad2s90: Make probe handle spi_setup failure
        staging: iio: ad7780: update voltage on read
        ARM: OMAP2+: hwmod: Fix some section annotations
        modpost: validate symbol names also in find_elf_symbol
        perf tools: Add Hygon Dhyana support
        soc/tegra: Don't leak device tree node reference
        f2fs: move dir data flush to write checkpoint process
        nfsd4: fix crash on writing v4_end_grace before nfsd startup
        arm64: ftrace: don't adjust the LR value
        media: DaVinci-VPBE: fix error handling in vpbe_initialize()
        smack: fix access permissions for keyring
        usb: hub: delay hub autosuspend if USB3 port is still link training
        timekeeping: Use proper seqcount initializer
        ARM: dts: Fix OMAP4430 SDP Ethernet startup
        mips: bpf: fix encoding bug for mm_srlv32_op
        sata_rcar: fix deferred probing
        clk: imx6sl: ensure MMDC CH0 handshake is bypassed
        cpuidle: big.LITTLE: fix refcount leak
        udf: Fix BUG on corrupted inode
        ARM: pxa: avoid section mismatch warning
        ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M
        memstick: Prevent memstick host from getting runtime suspended during card detection
        arm64: KVM: Skip MMIO insn after emulation
        powerpc/uaccess: fix warning/error with access_ok()
        xfrm6_tunnel: Fix spi check in __xfrm6_tunnel_alloc_spi
        drbd: narrow rcu_read_lock in drbd_sync_handshake
        drbd: disconnect, if the wrong UUIDs are attached on a connected peer
        drbd: skip spurious timeout (ping-timeo) when failing promote
        drbd: Avoid Clang warning about pointless switch statment
        video: clps711x-fb: release disp device node in probe()
        fbdev: fbmem: behave better with small rotated displays and many CPUs
        igb: Fix an issue that PME is not enabled during runtime suspend
        fbdev: fbcon: Fix unregister crash when more than one framebuffer
        NFS: nfs_compare_mount_options always compare auth flavors.
        hwmon: (lm80) fix a missing check of the status of SMBus read
        hwmon: (lm80) fix a missing check of bus read in lm80 probe
        crypto: ux500 - Use proper enum in cryp_set_dma_transfer
        crypto: ux500 - Use proper enum in hash_set_dma_transfer
        cifs: check ntwrk_buf_start for NULL before dereferencing it
        um: Avoid marking pages with "changed protection"
        niu: fix missing checks of niu_pci_eeprom_read
        scripts/decode_stacktrace: only strip base path when a prefix of the path
        ocfs2: don't clear bh uptodate for block read
        isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in HFCPCI_l1hw()
        gdrom: fix a memory leak bug
        block/swim3: Fix -EBUSY error when re-opening device after unmount
        kernel/hung_task.c: break RCU locks based on jiffies
        fs/epoll: drop ovflist branch prediction
        exec: load_script: don't blindly truncate shebang string
        thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set
        dccp: fool proof ccid_hc_[rt]x_parse_options()
        skge: potential memory corruption in skge_get_regs()
        net: systemport: Fix WoL with password after deep sleep
        net: dsa: slave: Don't propagate flag changes on down slave interfaces
        enic: fix checksum validation for IPv6
        ALSA: compress: Fix stop handling on compressed capture streams
        fuse: call pipe_buf_release() under pipe lock
        fuse: decrement NR_WRITEBACK_TEMP on the right page
        fuse: handle zero sized retrieve correctly
        dmaengine: imx-dma: fix wrong callback invoke
        usb: phy: am335x: fix race condition in _probe
        usb: gadget: udc: net2272: Fix bitwise and boolean operations
        KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222)
        KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221)
        perf/x86/intel/uncore: Add Node ID mask
        perf/core: Don't WARN() for impossible ring-buffer sizes
        perf tests evsel-tp-sched: Fix bitwise operator
        mtd: rawnand: gpmi: fix MX28 bus master lockup problem
        signal: Always notice exiting tasks
        signal: Better detection of synchronous signals
        misc: vexpress: Off by one in vexpress_syscfg_exec()
        debugfs: fix debugfs_rename parameter checking
        MIPS: OCTEON: don't set octeon_dma_bar_type if PCI is disabled
        ARM: iop32x/n2100: fix PCI IRQ mapping
        drm/modes: Prevent division by zero htotal
        drm/vmwgfx: Fix setting of dma masks
        drm/vmwgfx: Return error code from vmw_execbuf_copy_fence_user
        HID: debug: fix the ring buffer implementation
        libceph: avoid KEEPALIVE_PENDING races in ceph_con_keepalive()
        xfrm: refine validation of template and selector families
        batman-adv: Avoid WARN on net_device without parent in netns
        batman-adv: Force mac header to start of data on xmit
        usb: host: ehci-msm: fix handling platform_get_irq result
        Revert "exec: load_script: don't blindly truncate shebang string"
        ARM: dts: da850-evm: Correct the sound card name
        ARM: dts: kirkwood: Fix polarity of GPIO fan lines
        gpio: pl061: handle failed allocations
        cifs: Limit memory used by lock request calls to a page
        perf/core: Fix impossible ring-buffer sizes warning
        ALSA: usb-audio: Fix implicit fb endpoint setup by quirk
        Input: bma150 - register input device after setting private data
        Input: elantech - enable 3rd button support on Fujitsu CELSIUS H780
        alpha: fix page fault handling for r16-r18 targets
        alpha: Fix Eiger NR_IRQS to 128
        tracing/uprobes: Fix output for multiple string arguments
        signal: Restore the stop PTRACE_EVENT_EXIT
        x86/a.out: Clear the dump structure initially
        smsc95xx: Use skb_cow_head to deal with cloned skbs
        kaweth: use skb_cow_head() to deal with cloned skbs
        usb: dwc2: Remove unnecessary kfree
        pinctrl: msm: fix gpio-hog related boot issues
        Linux 3.18.135

Signed-off-by: Nathan Chancellor <[email protected]>

Conflicts:
	drivers/usb/host/ehci-msm.c

Initialize global mutex with DEFINE_MUTEX
to avoid calling mutex_lock without mutex_init.

CRs-fixed: 2392685
Change-Id: I847d86f493552524e8abec9a18525cdde8a8de23
Signed-off-by: Jhansi Konathala <[email protected]>

Change-Id: I2c73449f1e0e3033d7c056cbd412982647063aa3

Change-Id: If301e458a3a4b46b41efd41320d6692958809681

In low power mode stop DMA, turn off clocks
and vsync.

Change-Id: Ic6d4f1a2fdba9817633ba63c42f54f88e0c48d6f
Signed-off-by: Animesh Kishore <[email protected]>

During fb blank or dma stop check if there
are any pending retire fences. Signal all.

Change-Id: I24322c8eeb1afbd79c898d037b72b77df27a91fa
Signed-off-by: Animesh Kishore <[email protected]>

Changes in 3.18.136: (14 commits)
        net: fix IPv6 prefix route residue
        sky2: Increase D3 delay again
        tcp: tcp_v4_err() should be more careful
        tcp: clear icsk_backoff in tcp_write_queue_purge()
        vxlan: test dev->flags & IFF_UP before calling netif_rx()
        vsock: cope with memory allocation failure at socket creation time
        net: stmmac: Fix a race in EEE enable callback
        net: ipv4: use a dedicated counter for icmp_v4 redirect packets
        hwmon: (lm80) Fix missing unlock on error in set_fan_div()
        kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)
        net/x25: do not hold the cpu too long in x25_new_lci()
        mISDN: fix a race in dev_expire_timer()
        ax25: fix possible use-after-free
        Linux 3.18.136

Signed-off-by: Nathan Chancellor <[email protected]>

Adding code changes to validate buffer size.
While calling ipa_read verifying the kernel buffer
size in range or not.

Change-Id: I5c9a908b0500a5f0148ec7764425897570bdd713
Signed-off-by: Praveen Kurapati <[email protected]>

Power configuration is a value measured as HxW of a video session.
If the resolution of current video session meets this value, the
session will be configured in low power mode to get power benefits.
CRs-Fixed: 1106972

Change-Id: Ibe4eba7a76a070b1bc02caff89cfb871993043c2
Signed-off-by: Sanjay Singh <[email protected]>

Host will set the Venus firmware in below modes
1. If the load of current video session exceeds
the venus capability, video driver sets power
save mode for that session.
2. If an usecase is recommended to run in power
save mode to get power benefits, video driver
configures the session in power save mode.
3. If any V4L2 client makes an explicit call to
configure the usecase in a certain perf mode,
video driver sets the same to venus firmware,
unless restricted by core capability.

CRs-Fixed: 1106972
Change-Id: Ib8be6c9af1508389edc9cb6444531c6e711b6a11
Signed-off-by: Sanjay Singh <[email protected]>

Video session is made to run in TURBO mode during
various stages of the session. Video instance load
do not reflect the actual video load which can be
utilized to initialize DCVS state from the DCVS
table.

Change-Id: I539a7098159e6486e3c436c449a540c5ac60d6d3
Signed-off-by: Sanjay Singh <[email protected]>

Check if packet size is large enough to hold the header.

Change-Id: I7261f8111d8b5f4f7c181e469de248a732242d64
Signed-off-by: Vatsal Bucha <[email protected]>

…998"

Channel_mapping array size varies for different commands.
Add check for num_channels before calling q6asm_map_channels.

Change-Id: Iccbcfe82f716fc0ffe0a26b1779dcaa1c3cb805b
Signed-off-by: Rohit kumar <[email protected]>

Add range check to make sure the received audio port index
from ADSP is within the valid range.

Change-Id: Ief647df1659f7f349a843f666d8f92f34a9a43be
Signed-off-by: Xiaoyu Ye <[email protected]>

"LA.UM.7.5.r1-04300-8x96.0"

* tag 'LA.UM.7.5.r1-04300-8x96.0':
  iommu: iommu-debug: don't pass null character to copy_to_user
  arm64: Move BP hardening to check_and_switch_context
  soc: qcom: Validate read and write index before calculating ptr
  ARM: dts: msm: Disable APC CPR at cold for 9x07
  msm: ipa: Fix to validate the buffer size
  drivers: iio: imu: Fix NULL pointer dereference in bmi160 driver
  msm: vidc: ensure codec count is in supported session range
  iommu: dma-mapping-fast: Add a check for count in fast_smmu_alloc
  ARM: dts: mdm: Disable dynamic address for wlan ramdump
  checkpatch: Treat duplicate signatures as a different error class
  usb: gadget: f_mbim: Handle response complete before notify_complete
  usb: gadget: f_mbim: Use notify_req_queued instead of notify_count
  usb: gadget: f_mbim: Remove usage of notify_state
  SoC: msm: Add global mutex lock to fix the panic issue
  diag: Mark Buffer as NULL after freeing
  iommu/iommu-debug: fix buffer overflows in debugfs read functions
  ARM: dts: mdm: Enable dynamic address for wlan ramdump
  msm: ais: ispif: Fix invalid type conversion
  diag: Handle data ready notification properly
  msm: wlan: Update ETSI1 and ETSI13 countries
  msm: camera: isp: Fix invalid type conversion
  mdm: Update frequence & Tx power in the regulatory database
  netfilter: x_tables: kill check_entry helper
  drivers: iio: imu: increased the ASM buffer size
  defconfig: 8909: enable CONFIG_NETFILTER_XT_TARGET_TEE for iwlan scenarios
  ANDROID: sdcardfs: Change current->fs under lock
  msm: mdss: save state of vsync handler
  ANDROID: sdcardfs: Don't use OVERRIDE_CRED macro

Signed-off-by: Nathan Chancellor <[email protected]>

The range checking for audio buffer copying in function
"audio_in_write" is using the incorrect buffer size.
Change it to the actual allocated audio buffer size.

Change-Id: Ib7aaa2163c0d99161369eb85d09dc2d23d8c787b
Signed-off-by: Xiaoyu Ye <[email protected]>

Increment data ready only if it is not incremented earlier.

Change-Id: Ia61e638bcf18e17dfe4bef15fc8ed4168b4c1891
Signed-off-by: Sreelakshmi Gownipalli <[email protected]>

Validate buffer index obtained from ADSP token before using it.

CRs-Fixed: 2372302
Change-Id: I5c3b1634bd08b516844638dd67f726a882edfc17
Signed-off-by: Vignesh Kulothungan <[email protected]>

There can be many ice instances present in dtsi file but
not all of them will be initialized by storage driver.
Check if crypto instance is initialized before setting
it up for data encryption/decryption usage.

Change-Id: I7c9227007474052513b277dec5963a973781c524
Signed-off-by: Neeraj Soni <[email protected]>

Currently, mutex protection is missing while accessing md session's
info via macro. The patch adds proper protection before accessing
the same.

Change-Id: I17b18183407279447229783fd0165337bd173423
Signed-off-by: Hardik Arya <[email protected]>

There is a possibility of out-of-bound read if msg mask
ranges received from peripheral are more than max ssid per
range. Cap msg mask's ssid ranges to MAX_SSID_PER_RANGE if
ranges received from peripheral are greater than the same.

Change-Id: I886692ad223e16678bfaecbe381c62fdf3503cb5
Signed-off-by: Hardik Arya <[email protected]>

When processing WAN_IOC_SEND_LAN_CLIENT_MSG ioctl there is a possibility
of message_type being invalid and this can lead to out of buffer error.
Make a change to validate the ioctl params before processing.

Change-Id: If7955f77863b772ae1c8feda5ca0145c822403b9
Signed-off-by: Chaitanya Pratapa <[email protected]>

If video state set to DEINIT before processing all frame done
packets in the list may create video failures as explained below,
the client communication to video hardware will fail because of
DEINIT state and client will close the session upon failure which
will happen in parallel to response thread processing the response
packets in the list. It may happen that client already free'd the
buffer references and response thread might access the same buffer
reference and results in use-after-free memory fault. So In case
of sys error from video hardware, set video state to DEINIT after
processing all packets in the list to avoid use-after-free failure

Change-Id: Id44c26b1bbfc49e9725bf70e21a3e861a04d0133
Signed-off-by: Maheshwar Ajja <[email protected]>
Signed-off-by: Sanjay Singh <[email protected]>

SPI fps calculation was over-riding the DTV fps
calculation due to a missing break statement.
Correct this so that fps is calculated in default case.

Change-Id: I07da394d44827ddb9be999a63f34e56e3fd2b373
Signed-off-by: Raghavendra Ambadas <[email protected]>

No need to process response messages from video hardware
after device went into invalid state. Processing responses
may result in use-after-free memory fault because client
might free all the resources after error

Change-Id: Ia2c22a2740466e6368e61437aa4246927150858b
Signed-off-by: Maheshwar Ajja <[email protected]>
Signed-off-by: Sanjay Singh <[email protected]>

Token from DSP might be invalid for array index. Validate the
token before being used as array index.

Change-Id: I9f47e1328d75d9f9acf7e85ddb452019b6eced0a
Signed-off-by: Xiaojun Sang <[email protected]>

Payload size is not checked before payload access. Check payload
size to avoid out-of-boundary memory access.

Change-Id: Iaa39ee4ea5489bb5579e7b7d5dfada12d88c5809
Signed-off-by: Xiaojun Sang <[email protected]>

Changes in 3.18.137: (135 commits)
        ceph: avoid repeatedly adding inode to mdsc->snap_flush_list
        numa: change get_mempolicy() to use nr_node_ids instead of MAX_NUMNODES
        KEYS: allow reaching the keys quotas exactly
        mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells
        mfd: twl-core: Fix section annotations on {,un}protect_pm_master
        mfd: db8500-prcmu: Fix some section annotations
        mfd: ab8500-core: Return zero in get_register_interruptible()
        mfd: wm5110: Add missing ASRC rate register
        mfd: mc13xxx: Fix a missing check of a register-read failure
        MIPS: ath79: Enable OF serial ports in the default config
        scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param
        scsi: isci: initialize shost fully before calling scsi_add_host()
        MIPS: jazz: fix 64bit build
        isdn: i4l: isdn_tty: Fix some concurrency double-free bugs
        atm: he: fix sign-extension overflow on large shift
        leds: lp5523: fix a missing check of return value of lp55xx_read
        isdn: avm: Fix string plus integer warning from Clang
        KEYS: user: Align the payload buffer
        KEYS: always initialize keyring_index_key::desc_len
        batman-adv: fix uninit-value in batadv_interface_tx()
        net/packet: fix 4gb buffer limit due to overflow check
        team: avoid complex list operations in team_nl_cmd_options_set()
        sit: check if IPv6 enabled before calling ip6_err_gen_icmpv6_unreach()
        netlink: Trim skb to alloc size to avoid MSG_TRUNC
        libceph: handle an empty authorize reply
        scsi: libsas: Fix rphy phy_identifier for PHYs with end devices attached
        drm/msm: Unblock writer if reader closes file
        ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field
        ALSA: compress: prevent potential divide by zero bugs
        usb: dwc3: gadget: Fix the uninitialized link_state when udc starts
        usb: gadget: Potential NULL dereference on allocation error
        ASoC: imx-audmux: change snprintf to scnprintf for possible overflow
        mac80211: fix miscounting of ttl-dropped frames
        serial: fsl_lpuart: fix maximum acceptable baud rate with over-sampling
        scsi: csiostor: fix NULL pointer dereference in csio_vport_set_state()
        net: altera_tse: fix connect_local_phy error path
        ibmveth: Do not process frames after calling napi_reschedule
        mac80211: don't initiate TDLS connection if station is not associated to AP
        cfg80211: extend range deviation for DMG
        KVM: nSVM: clear events pending from svm_complete_interrupts() when exiting to L1
        mmc: spi: Fix card detection during probe
        mm: enforce min addr even if capable() in expand_downwards()
        USB: serial: cp210x: add ID for Ingenico 3070
        net-sysfs: Fix mem leak in netdev_register_kobject
        sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79
        team: Free BPF filter when unregistering netdev
        net: nfc: Fix NULL dereference on nfc_llcp_build_tlv fails
        net: Add __icmp_send helper.
        net: avoid use IPCB in cipso_v4_error
        net: phy: Micrel KSZ8061: link failure after cable connect
        netlabel: fix out-of-bounds memory accesses
        ip6mr: Do not call __IP6_INC_STATS() from preemptible context
        hugetlbfs: fix races and page leaks during migration
        media: uvcvideo: Fix 'type' check leading to overflow
        vti4: Fix a ipip packet processing bug in 'IPCOMP' virtual tunnel
        perf tools: Handle TOPOLOGY headers with no CPU
        ipvs: Fix signed integer overflow when setsockopt timeout
        iommu/amd: Fix IOMMU page flush when detach device from a domain
        xtensa: SMP: fix secondary CPU initialization
        xtensa: smp_lx200_defconfig: fix vectors clash
        xtensa: SMP: mark each possible CPU as present
        xtensa: SMP: limit number of possible CPUs by NR_CPUS
        net: altera_tse: fix msgdma_tx_completion on non-zero fill_level case
        nfs: Fix NULL pointer dereference of dev_name
        scsi: libfc: free skb when receiving invalid flogi resp
        platform/x86: Fix unmet dependency warning for SAMSUNG_Q10
        cifs: fix computation for MAX_SMB2_HDR_SIZE
        x86/kexec: Don't setup EFI info if EFI runtime is not enabled
        mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone
        autofs: drop dentry reference only when it is never used
        autofs: fix error return in autofs_fill_super()
        ARM: pxa: ssp: unneeded to free devm_ allocated data
        irqchip/mmp: Only touch the PJ4 IRQ & FIQ bits on enable/disable
        dmaengine: dmatest: Abort test in case of mapping error
        s390/qeth: fix use-after-free in error path
        perf symbols: Filter out hidden symbols from labels
        Input: wacom_serial4 - add support for Wacom ArtPad II tablet
        iscsi_ibft: Fix missing break in switch statement
        l2tp: fix infoleak in l2tp_ip6_recvmsg()
        net: hsr: fix memory leak in hsr_dev_finalize()
        net: sit: fix UBSAN Undefined behaviour in check_6rd
        net/x25: fix use-after-free in x25_device_event()
        net/x25: reset state in x25_connect()
        pptp: dst_release sk_dst_cache in pptp_sock_destruct
        net/mlx4_core: Fix qp mtt size calculation
        net/x25: fix a race in x25_bind()
        mdio_bus: Fix use-after-free on device_register fails
        net: Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255
        missing barriers in some of unix_sock ->addr and ->path accesses
        vxlan: test dev->flags & IFF_UP before calling gro_cells_receive()
        net/hsr: fix possible crash in add_timer()
        gro_cells: make sure device is up in gro_cells_receive()
        ALSA: bebob: use more identical mod_alias for Saffire Pro 10 I/O against Liquid Saffire 56
        It's wrong to add len to sector_nr in raid10 reshape twice
        9p/net: fix memory leak in p9_client_create
        ASoC: fsl_esai: fix register setting issue in RIGHT_J mode
        crypto: ahash - fix another early termination in hash walk
        s390/dasd: fix using offset into zero size array error
        Input: matrix_keypad - use flush_delayed_work()
        i2c: cadence: Fix the hold bit setting
        Input: st-keyscan - fix potential zalloc NULL dereference
        assoc_array: Fix shortcut creation
        scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task
        net: systemport: Fix reception of BPDUs
        net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe()
        arm64: Relax GIC version check during early boot
        tmpfs: fix link accounting when a tmpfile is linked in
        net: set static variable an initial value in atl2_probe()
        CIFS: Fix read after write for files with read caching
        regulator: s2mps11: Fix steps for buck7, buck8 and LDO35
        regulator: s2mpa01: Fix step values for some LDOs
        scsi: virtio_scsi: don't send sc payload with tmfs
        scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock
        m68k: Add -ffreestanding to CFLAGS
        Btrfs: fix corruption reading shared and compressed extents after hole punching
        crypto: pcbc - remove bogus memcpy()s with src == dest
        cpufreq: pxa2xx: remove incorrect __init annotation
        ext4: fix crash during online resizing
        ext2: Fix underflow in ext2_max_size()
        mm/vmalloc: fix size check for remap_vmalloc_range_partial()
        kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv
        parport_pc: fix find_superio io compare code, should use equal test.
        jbd2: clear dirty flag when revoking a buffer from an older transaction
        powerpc/32: Clear on-stack exception marker upon exception return
        powerpc/wii: properly disable use of BATs when requested.
        powerpc/powernv: Make opal log only readable by root
        powerpc/83xx: Also save/restore SPRG4-7 during suspend
        ARM: s3c24xx: Fix boolean expressions in osiris_dvs_notify
        nfsd: fix memory corruption caused by readdir
        nfsd: fix wrong check in write_v4_end_grace()
        md: Fix failed allocation of md_register_thread
        media: uvcvideo: Avoid NULL pointer dereference at the end of streaming
        drm/radeon/evergreen_cs: fix missing break in switch statement
        tmpfs: fix uninitialized return value in shmem_link
        Linux 3.18.137

Signed-off-by: Nathan Chancellor <[email protected]>

Conflicts:
	sound/core/compress_offload.c

The GCC wrapper writes any error message from GCC to stdout
along with the messages from the wrapper itself. This is okay
for most case, but when GCC is used with -print-xxx flags,
the stdout output is supposed to be taken as input to some
other build command, so putting error messages in there is
pretty bad. Fix this by writing error messages to stderr.

Change-Id: I4656033f11ba5212fdcc884cc588f8b9d2c23419
Signed-off-by: Shadab Naseem <[email protected]>

Fix errors reported after enabling Kernel Control Flow
Integrity (KCFI) on kernel code. This is a security
mechanism that disallows changes to the original control
flow of a compiled binary.

Change-Id: I1e1e901c5889d9928411dc785da88e1eac378568
Signed-off-by: Govindaraj Rajagopal <[email protected]>

Opening of multiple instance of voice_svc user space from app will
lead to pointer deference of private data within apr callback. As
multi-instance not supported added check to deny open() from user
space if previous instance hasn't been closed.

Change-Id: Ia5ef16c69a517760fc9d45530a8a41a333fa2a21
Signed-off-by: Ajit Pandey <[email protected]>

Check size of payload array before access in q6usm_callback.

Change-Id: Id0c85209a053f9dfdb53133aeb6b2510ecf18eb8
Signed-off-by: Vatsal Bucha <[email protected]>

Check size of payload before access in q6usm_mmapcallback.

Change-Id: Iff0672532c2ea40e7129237a92d8365d6b554cf2
Signed-off-by: Vatsal Bucha <[email protected]>

Check buffer size in qdsp_cvs_callback before access in
ul_pkt.

Change-Id: Ic19994b46086709231656ec747d2df988b7a512f
Signed-off-by: Vatsal Bucha <[email protected]>

Changes in 3.18.138: (51 commits)
        udf: Fix crash on IO error during truncate
        futex: Ensure that futex address is aligned in handle_futex_death()
        ext4: fix NULL pointer dereference while journal is aborted
        ext4: fix data corruption caused by unaligned direct AIO
        ext4: brelse all indirect buffer in ext4_ind_remove_space()
        mmc: tmio_mmc_core: don't claim spurious interrupts
        media: v4l2-ctrls.c/uvc: zero v4l2_event
        Bluetooth: Check L2CAP option sizes returned from l2cap_get_conf_opt
        Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer
        mmc: block: Allow more than 8 partitions per card
        arm64: fix COMPAT_SHMLBA definition for large pages
        ARM: 8458/1: bL_switcher: add GIC dependency
        android: unconditionally remove callbacks in sync_fence_free()
        asm-generic: Fix local variable shadow in __set_fixmap_offset
        staging: ashmem: Avoid deadlock with mmap/shrink
        staging: ashmem: Add missing include
        staging: ion: Set minimum carveout heap allocation order to PAGE_SHIFT
        staging: goldfish: audio: fix compiliation on arm
        ARM: 8510/1: rework ARM_CPU_SUSPEND dependencies
        arm64/kernel: fix incorrect EL0 check in inv_entry macro
        arm64: kernel: Include _AC definition in page.h
        ipv6: fix endianness error in icmpv6_err
        usb: gadget: configfs: add mutex lock before unregister gadget
        video: fbdev: Set pixclock = 0 in goldfishfb
        arm64: kconfig: drop CONFIG_RTC_LIB dependency
        mmc: mmc: fix switch timeout issue caused by jiffies precision
        cfg80211: size various nl80211 messages correctly
        dccp: do not use ipv6 header for ipv4 flow
        mISDN: hfcpci: Test both vendor & device ID for Digium HFC4S
        net/packet: Set __GFP_NOWARN upon allocation in alloc_pg_vec
        net: rose: fix a possible stack overflow
        Add hlist_add_tail_rcu() (Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net)
        packets: Always register packet sk in the same order
        tcp: do not use ipv6 header for ipv4 flow
        sctp: get sctphdr by offset in sctp_compute_cksum
        mac8390: Fix mmio access size probe
        ALSA: pcm: Fix possible OOB access in PCM oss plugins
        ALSA: pcm: Don't suspend stream in unrecoverable PCM state
        scsi: zfcp: fix scsi_eh host reset with port_forced ERP for non-NPIV FCP devices
        serial: max310x: Fix to avoid potential NULL pointer dereference
        USB: serial: cp210x: add new device id
        USB: serial: ftdi_sio: add additional NovaTech products
        USB: serial: mos7720: fix mos_parport refcount imbalance on error path
        Disable kgdboc failed by echo space to /sys/module/kgdboc/parameters/kgdboc
        fs/proc/proc_sysctl.c: fix NULL pointer dereference in put_links
        gpio: adnp: Fix testing wrong value in adnp_gpio_direction_input
        KVM: Reject device ioctls from processes other than the VM's creator
        xhci: Fix port resume done detection for SS ports with LPM enabled
        ARM: imx6q: cpuidle: fix bug that CPU might not wake up at expected time
        arm64: support keyctl() system call in 32-bit mode
        Linux 3.18.138

Signed-off-by: Nathan Chancellor <[email protected]>

Conflicts:
	drivers/staging/android/sync.c

Release spinlock in EVENT_READ_DONE before return
if payload size is invalid.

Change-Id: I0fe4f841ce73ecfc30fe70334e203443e5e2cb28
Signed-off-by: Vatsal Bucha <[email protected]>

Change-Id: I8f7825d87a14928960258fa55e6ff1908eea41f3

Change-Id: Icd9c6b31b9930f9190e3bd241ec4b9741f0e2e5e

Check the size of ADSP payload before accessing it.

CRs-Fixed: 2380694
Change-Id: I52e74e5a86499ea61f8426f767948ce940d4d59c
Signed-off-by: Vignesh Kulothungan <[email protected]>

Check if payload data is big enough before accessing
the data in it.

Change-Id: I939f205a8cebf6ef4859f81fae5429bca013d540
Signed-off-by: Karthikeyan Mani <[email protected]>

…ance"

…size"

The QMI TLV value for strings in a lot of qmi element info structures
account for null terminated strings with MAX_LEN + 1. If a string is
actually MAX_LEN + 1 length, this will cause an out of bounds access
when the NULL character is appended in decoding.

CR-Fixed: 2359244
Change-Id: I4d789bc6017ff58458f77fe875ca4e175a4f1357
Signed-off-by: Chris Lew <[email protected]>
Signed-off-by: Deepak Kumar Singh <[email protected]>

"LA.UM.7.5.r1-04500-8x96.0"

* tag 'LA.UM.7.5.r1-04500-8x96.0':
  msm: vidc: fix KCFI errors
  scripts: gcc-wrapper: Route the GCC errors to stderr
  dsp: asm: validate payload size before access
  dsp: validate token before usage as array index
  msm: vidc: ignore processing responses in invalid state
  msm: mdss: correct the DTV panel fps calculation
  msm: vidc: do not set video state to DEINIT very early
  msm: ipa: fix to validate the ioctl WAN_IOC_SEND_LAN_CLIENT_MSG params
  diag: Update msg mask's ranges properly
  diag: Add missing protection while accessing session's info
  msm: ice: check for crypto engine availability
  msm: asm: validate ADSP data before access
  diag: Increment data ready only if it is first update
  dsp: codecs: fix range check for audio buffer copying
  ASoC: msm: qdsp6v2: add range check for audio port index
  dsp: asm: Add check for num_channels before calling q6asm_map_channels
  qdsp6v2: apr: check for packet size to header size comparison
  msm: vidc: Initialize DCVS load properly
  msm: vidc: Handle perf mode configuration
  ARM: dts: msm: Define power configuration for msm8996 and msm8998
  fbdev: mdss: Signal pending retire fence
  mdss: mdp3: Optimize power save in lp mode
  ASoC: msm: Initialize global Mutex in audio_cal_utils

Signed-off-by: Nathan Chancellor <[email protected]>

Validate the dci entries and its task structure before
accessing structure members to prevent copying dci data to
invalid entries.

Change-Id: I07c59ef0705bc52a8268b0dc984ebfa9d26d178e
Signed-off-by: Manoj Prabhu B <[email protected]>

Expected buffer size to read is 2 bytes.
Corrected the size check to return error
when count is not 2.

Change-Id: I43b572d191f6f98a8a790b5ae77b43fabcd7329a
Signed-off-by: Soumya Managoli <[email protected]>

…out"

Check size of payload array before access in qdsp_mvm_callback.

Change-Id: I81d945f963cfb4a3cb26155700b82880d891ec5e
Signed-off-by: Vatsal Bucha <[email protected]>

Payload size validity is not checked before using it in array index.
Check payload size to avoid out-of-boundary memory.

Change-Id: Ic0b06bb331fc1753ff7543bb218ab12d6a4a3ca8
Signed-off-by: Kunlei Zhang <[email protected]>

Change-Id: Iec1e9320f920825a64846af6a9488f321f7a66eb

Payload size is not checked before memory copy.
Check payload size to avoid out-of-boundary memory
access.

Change-Id: I07857564d4e8ce415df3810b25f0e9e17a60993d
Signed-off-by: Kunlei Zhang <[email protected]>

Changes in 3.18.139: (105 commits)
        ext4: cleanup bh release code in ext4_ind_remove_space()
        i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA
        tracing: kdb: Fix ftdump to not sleep
        sysctl: handle overflow for file-max
        mm/cma.c: cma_declare_contiguous: correct err handling
        mm/vmalloc.c: fix kernel BUG at mm/vmalloc.c:512!
        mm/slab.c: kmemleak no scan alien caches
        ocfs2: fix a panic problem caused by o2cb_ctl
        cifs: use correct format characters
        dm thin: add sanity checks to thin-pool and external snapshot creation
        cifs: Fix NULL pointer dereference of devname
        fs: fix guard_bio_eod to check for real EOD errors
        tools lib traceevent: Fix buffer overflow in arg_eval
        scsi: core: replace GFP_ATOMIC with GFP_KERNEL in scsi_scan.c
        ARM: 8840/1: use a raw_spinlock_t in unwind
        mmc: omap: fix the maximum timeout setting
        e1000e: Fix -Wformat-truncation warnings
        IB/mlx4: Increase the timeout for CM cache
        scsi: megaraid_sas: return error when create DMA pool failed
        SoC: imx-sgtl5000: add missing put_device()
        leds: lp55xx: fix null deref on firmware load failure
        kprobes: Prohibit probing on bsearch()
        ARM: 8833/1: Ensure that NEON code always compiles with Clang
        ALSA: PCM: check if ops are defined before suspending PCM
        bcache: fix input overflow to cache set sysfs file io_error_halflife
        bcache: fix input overflow to sequential_cutoff
        bcache: improve sysfs_strtoul_clamp()
        fbdev: fbmem: fix memory access if logo is bigger than the screen
        cdrom: Fix race condition in cdrom_sysctl_register
        tty: increase the default flip buffer limit to 2*640K
        media: mt9m111: set initial frame size other than 0x0
        hwrng: virtio - Avoid repeated init of completion
        hpet: Fix missing '=' character in the __setup() code of hpet_mmap_enable
        dmaengine: imx-dma: fix warning comparison of distinct pointer types
        media: s5p-jpeg: Check for fmt_ver_flag when doing fmt enumeration
        wlcore: Fix memory leak in case wl12xx_fetch_firmware failure
        x86/build: Mark per-CPU symbols as absolute explicitly for LLD
        dmaengine: tegra: avoid overflow of byte tracking
        drm/dp/mst: Configure no_stop_bit correctly for remote i2c xfers
        binfmt_elf: switch to new creds when switching to new mm
        lib/string.c: implement a basic bcmp
        tty: mark Siemens R3964 line discipline as BROKEN
        tty: ldisc: add sysctl to prevent autoloading of ldiscs
        openvswitch: fix flow actions reallocation
        qmi_wwan: add Olicard 600
        sctp: initialize _pad of sockaddr_in before copying to user memory
        netns: provide pure entropy for net_hash_mix()
        net: ethtool: not call vzalloc for zero sized memory request
        ip6_tunnel: Match to ARPHRD_TUNNEL6 for dev type
        ALSA: seq: Fix OOB-reads from strlcpy
        ASoC: fsl_esai: fix channel swap issue when stream starts
        block: do not leak memory in bio_copy_user_iov()
        arm64: futex: Fix FUTEX_WAKE_OP atomic ops with non-zero result value
        xen: Prevent buffer overflow in privcmd ioctl
        sched/fair: Do not re-read ->h_load_next during hierarchical load calculation
        xtensa: fix return_address
        PCI: Add function 1 DMA alias quirk for Marvell 9170 SATA controller
        string: drop __must_check from strscpy() and restore strscpy() usages in cgroup
        perf/core: Restore mmap record type correctly
        ext4: report real fs size after failed resize
        ALSA: echoaudio: add a check for ioremap_nocache
        ALSA: sb8: add a check for request_region
        IB/mlx4: Fix race condition between catas error reset and aliasguid flows
        mmc: davinci: remove extraneous __init annotation
        ALSA: opl3: fix mismatch between snd_opl3_drum_switch definition and declaration
        thermal/int340x_thermal: fix mode setting
        tools/power turbostat: return the exit status of a command
        perf top: Fix error handling in cmd_top()
        perf tests: Fix a memory leak in test__perf_evsel__tp_sched_test()
        x86/hpet: Prevent potential NULL pointer dereference
        x86/cpu/cyrix: Use correct macros for Cyrix calls on Geode processors
        iommu/vt-d: Check capability before disabling protected memory
        fix incorrect error code mapping for OBJECTID_NOT_FOUND
        rsi: improve kernel thread handling to fix kernel panic
        9p: do not trust pdu content for stat item size
        9p locks: add mount option for lock retry interval
        serial: uartps: console_setup() can't be placed to init section
        ARM: samsung: Limit SAMSUNG_PM_CHECK config option to non-Exynos platforms
        ACPI / SBS: Fix GPE storm on recent MacBookPro's
        iommu/dmar: Fix buffer overflow during PCI bus notification
        appletalk: Fix use-after-free in atalk_proc_exit
        lib/div64.c: off by one in shift
        include/linux/swap.h: use offsetof() instead of custom __swapoffset macro
        inet: update the IP ID generation algorithm to higher standards.
        appletalk: Fix compile regression
        crypto: crypto4xx - properly set IV after de- and encrypt
        tpm/tpm_i2c_atmel: Return -E2BIG when the transfer is incomplete
        bonding: fix event handling for stacked bonds
        net: bridge: multicast: use rcu to access port list from br_multicast_start_querier
        ipv4: recompile ip options in ipv4_link_failure
        ipv4: ensure rcu_read_lock() in ipv4_link_failure()
        tcp: tcp_grow_window() needs to respect tcp_space()
        iio: ad_sigma_delta: select channel when reading register
        iio: adc: at91: disable adc channel interrupt in timeout case
        staging: comedi: vmk80xx: Fix use of uninitialized semaphore
        staging: comedi: vmk80xx: Fix possible double-free of ->usb_rx_buf
        staging: comedi: ni_usb6501: Fix possible double-free of ->usb_rx_buf
        ALSA: core: Fix card races between register and disconnect
        x86/kprobes: Verify stack frame on kretprobe
        kprobes: Fix error check when reusing optimized probes
        sched/fair: Limit sched_cfs_period_timer() loop to avoid hard lockup
        device_cgroup: fix RCU imbalance in error case
        arm64: futex: Restore oldval initialization to work around buggy compilers
        kernel/sysctl.c: fix out-of-bounds access when setting file-max
        Linux 3.18.139

Signed-off-by: Nathan Chancellor <[email protected]>

Conflicts:
	drivers/tty/tty_buffer.c
	include/net/netns/hash.h

Payload size validity is not checked before using it in array index.
Check payload size to avoid out-of-boundary memory.

Change-Id: Ic0b06bb331fc1753ff7543bb218ab12d6a4a3ca8
Signed-off-by: Kunlei Zhang <[email protected]>

Ignore DSI FIFO overflow errors while sending DCS
commands in dma_tpg_tx path. This extends the handling
of overflow as done in non-TPG path through commit
2aa6192 "msm: mdss:
ignore overflow error when sending dcs command" to
the dma_tpg path.

Change-Id: I9ab9b79d7c2100cf9f2e7c01983500c098a12770
Signed-off-by: Nirmal Abraham <[email protected]>

In current implementation, count becomes -1 when number
of clusters passed is 0, resulting in invalid address.
This change fixes issue by bailing out when number of
clusters passed is 0.

Change-Id: I240333501815654d40e4b6bde7ed4dc06615f9c6
Signed-off-by: Chetan C R <[email protected]>
Signed-off-by: Karthik Gopalan <[email protected]>
Signed-off-by: Shashi Shekar Shankar <[email protected]>

Prevent possible out of bound access due to missing length check
while extracting dci packet response by adding proper checks.

CRs-Fixed: 2434571
Change-Id: I7b6972bf6559bdca99333a75d989cd6d3431b801
Signed-off-by: Manoj Prabhu B <[email protected]>

Restrict printing of kernel virtual addresses in SPS driver.

In debug prints, handles to bam device structures may be printed
as integers. As these handles are obtained by casting pointer
to bam device structures to integer, they can reveal addresses
of the structures to attackers.

Cast the handles in debug prints to pointers, printed with with %pK,
which hides these values if kptr_restrict is set (default on Android).

Change-Id: Idd28c7d11a06113605f7428a4cfc2505c1ae0073
Signed-off-by: Jishnu Prakash <[email protected]>

"LA.UM.7.5.r1-04800-8x96.0"

* tag 'LA.UM.7.5.r1-04800-8x96.0':
  lsm: check payload size validity before using it as array index
  ASoC: msm: Modify buf size check to prevent OOB error
  soc: qcom: qmi_encdec: Restrict string length in decode
  dsp: afe: check for payload size before payload access
  msm: adm: validate ADSP payload size before access
  dsp: q6usm: Release spinlock before return if invalid payload size
  dsp: q6voice: Check size of shared memory buffer before access
  qdsp6v2: q6usm: Check size of payload before access
  qdsp6v2: q6usm: Check size of payload before access
  drivers: soc: qcom: Added check to avoid opening multiple instance
  msm: kgsl: Limit log frequency in case of context count maxed out

Signed-off-by: Nathan Chancellor <[email protected]>

currently only NULL pointer check is used to validate the return
value from clk_get, this change to handle all the failures.

Change-Id: Icd8b7e33d0f235a7c5dde2307972a594908e6a60
Signed-off-by: Srikanth Uyyala <[email protected]>
Signed-off-by: Vandana Jain <[email protected]>

currently only NULL pointer check is used to validate the return
value from clk_get, this change to handle all the failures.

Change-Id: I3f981b0a2605dbf57d1a22222f9fb56fa882ec8b
Signed-off-by: E V Ravi <[email protected]>

While processing a packet containing command request, buffer size
need to be checked against size of the command structures that is
being parsed to prevent possible out of bound access.

CRs-Fixed: 2432633
Change-Id: I048bdbd0c096a6d03501bdd5b1d2d4bb50d45dd6
Signed-off-by: Manoj Prabhu B <[email protected]>

Lock Implementation for avoid race condition leading
to out-of-bound write in "msm_vb2_queue_setup

CRs-Fixed: 2362627

Change-Id: I5b9eeb35eb47cfb7b0dc8c0db17b4af359967f1c
Signed-off-by: E V Ravi <[email protected]>

Lock Implementation for avoid race condition leading
to out-of-bound write in "msm_vb2_queue_setup

CRs-Fixed: 2362627
Change-Id: I7f7420c7437b9ac2f215929a8614b0846e890c98
Signed-off-by: Vijay kumar Tumati <[email protected]>
Signed-off-by: Vandana Jain <[email protected]>