Merge 2d9d343 on remote branch

Change-Id: I1a77be01e703e03624f53d1375acfb1b5314f72c

drivers/char/adsprpc.c

@@ -1874,8 +1874,10 @@ static void file_free_work_handler(struct work_struct *w)
 			break;
 		}
 		mutex_unlock(&me->flfree_mutex);
-		if (freefl)
+		if (freefl) {
 			fastrpc_file_free(freefl->fl);
+			kfree(freefl);
+		}
 		mutex_lock(&me->flfree_mutex);
 
 		if (hlist_empty(&me->fls)) {
@@ -1885,7 +1887,6 @@ static void file_free_work_handler(struct work_struct *w)
 			break;
 		}
 		mutex_unlock(&me->flfree_mutex);
-		kfree(freefl);
 	}
 	return;
 }

drivers/hid/usbhid/hiddev.c

@@ -510,18 +510,19 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
 				goto inval;
 
 			field = report->field[uref->field_index];
+		}
 
-			if (cmd == HIDIOCGCOLLECTIONINDEX) {
-				if (uref->usage_index >= field->maxusage)
-					goto inval;
-			} else if (uref->usage_index >= field->report_count)
+		if (cmd == HIDIOCGCOLLECTIONINDEX) {
+			if (uref->usage_index >= field->maxusage)
 				goto inval;
+		} else if (uref->usage_index >= field->report_count)
+			goto inval;
 
-			else if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
-				 (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
-				  uref->usage_index + uref_multi->num_values > field->report_count))
-				goto inval;
-		}
+		else if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
+			 (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
+			uref->usage_index + uref_multi->num_values >
+			field->report_count))
+			goto inval;
 
 		switch (cmd) {
 		case HIDIOCGUSAGE:

drivers/input/touchscreen/gt9xx/goodix_tool.c

@@ -27,7 +27,7 @@
 #include <linux/debugfs.h>
 
 #define DATA_LENGTH_UINT    512
-#define CMD_HEAD_LENGTH     (sizeof(struct st_cmd_head) - sizeof(u8 *))
+#define CMD_HEAD_LENGTH     (sizeof(struct st_cmd_head))
 static char procname[20] = {0};
 
 struct st_cmd_head {
@@ -44,10 +44,10 @@ struct st_cmd_head {
 	u8  addr_len;	/* address length */
 	u8  addr[2];	/* address */
 	u8  res[3];	/* reserved */
-	u8  *data;	/* data pointer */
 } __packed;
 
 static struct st_cmd_head cmd_head;
+static u8 *cmd_data;
 
 static struct i2c_client *gt_client;
 
@@ -192,7 +192,7 @@ static void unregister_i2c_func(void)
 
 void uninit_wr_node(void)
 {
-	cmd_head.data = NULL;
+	cmd_data = NULL;
 	unregister_i2c_func();
 	proc_remove(goodix_proc_entry);
 }
@@ -309,7 +309,6 @@ static s32 goodix_tool_write(struct file *filp, const char __user *userbuf,
 						size_t count, loff_t *ppos)
 {
 	s32 ret = 0;
-	u8 *dataptr = NULL;
 
 	mutex_lock(&lock);
 	ret = copy_from_user(&cmd_head, userbuf, CMD_HEAD_LENGTH);
@@ -341,14 +340,14 @@ static s32 goodix_tool_write(struct file *filp, const char __user *userbuf,
 	}
 
 	if (cmd_head.wr == GTP_RW_WRITE) {
-		ret = copy_from_user(&cmd_head.data[GTP_ADDR_LENGTH],
+		ret = copy_from_user(&cmd_data[GTP_ADDR_LENGTH],
 				&userbuf[CMD_HEAD_LENGTH], cmd_head.data_len);
 		if (ret) {
 			dev_err(&gt_client->dev, "copy_from_user failed.");
 			goto exit;
 		}
 
-		memcpy(&cmd_head.data[GTP_ADDR_LENGTH - cmd_head.addr_len],
+		memcpy(&cmd_data[GTP_ADDR_LENGTH - cmd_head.addr_len],
 					cmd_head.addr, cmd_head.addr_len);
 
 		if (cmd_head.flag == GTP_NEED_FLAG) {
@@ -361,7 +360,7 @@ static s32 goodix_tool_write(struct file *filp, const char __user *userbuf,
 			/* Need interrupt! */
 		}
 		if (tool_i2c_write(
-		&cmd_head.data[GTP_ADDR_LENGTH - cmd_head.addr_len],
+		&cmd_data[GTP_ADDR_LENGTH - cmd_head.addr_len],
 		cmd_head.data_len + cmd_head.addr_len) <= 0) {
 			dev_err(&gt_client->dev, "Write data failed!");
 			ret = -EIO;
@@ -374,7 +373,7 @@ static s32 goodix_tool_write(struct file *filp, const char __user *userbuf,
 		ret = cmd_head.data_len + CMD_HEAD_LENGTH;
 		goto exit;
 	} else if (cmd_head.wr == GTP_RW_WRITE_IC_TYPE) {  /* Write ic type */
-		ret = copy_from_user(&cmd_head.data[0],
+		ret = copy_from_user(&cmd_data[0],
 				&userbuf[CMD_HEAD_LENGTH],
 				cmd_head.data_len);
 		if (ret) {
@@ -389,7 +388,7 @@ static s32 goodix_tool_write(struct file *filp, const char __user *userbuf,
 			ret = -EINVAL;
 			goto exit;
 		}
-		memcpy(ic_type, cmd_head.data, cmd_head.data_len);
+		memcpy(ic_type, cmd_data, cmd_head.data_len);
 
 		register_i2c_func();
 
@@ -417,13 +416,13 @@ static s32 goodix_tool_write(struct file *filp, const char __user *userbuf,
 	} else if (cmd_head.wr == GTP_RW_CHECK_RAWDIFF_MODE) {
 		struct goodix_ts_data *ts = i2c_get_clientdata(gt_client);
 
-		ret = copy_from_user(&cmd_head.data[GTP_ADDR_LENGTH],
+		ret = copy_from_user(&cmd_data[GTP_ADDR_LENGTH],
 				&userbuf[CMD_HEAD_LENGTH], cmd_head.data_len);
 		if (ret) {
 			pr_debug("copy_from_user failed.");
 			goto exit;
 		}
-		if (cmd_head.data[GTP_ADDR_LENGTH]) {
+		if (cmd_data[GTP_ADDR_LENGTH]) {
 			pr_debug("gtp enter rawdiff.");
 			ts->gtp_rawdiff_mode = true;
 		} else {
@@ -451,22 +450,20 @@ static s32 goodix_tool_write(struct file *filp, const char __user *userbuf,
 			ret = -EINVAL;
 			goto exit;
 		}
-		memset(cmd_head.data, 0, cmd_head.data_len + 1);
-		memcpy(cmd_head.data, &userbuf[CMD_HEAD_LENGTH],
+		memset(cmd_data, 0, cmd_head.data_len + 1);
+		memcpy(cmd_data, &userbuf[CMD_HEAD_LENGTH],
 					cmd_head.data_len);
 
-		if (gup_update_proc((void *)cmd_head.data) == FAIL) {
+		if (gup_update_proc((void *)cmd_data) == FAIL) {
 			ret = -EBUSY;
 			goto exit;
 		}
 	}
 	ret = CMD_HEAD_LENGTH;
 
 exit:
-	dataptr = cmd_head.data;
 	memset(&cmd_head, 0, sizeof(cmd_head));
 	cmd_head.wr = 0xFF;
-	cmd_head.data = dataptr;
 
 	mutex_unlock(&lock);
 	return ret;
@@ -506,10 +503,10 @@ static s32 goodix_tool_read(struct file *file, char __user *user_buf,
 			/* Need interrupt! */
 		}
 
-		memcpy(cmd_head.data, cmd_head.addr, cmd_head.addr_len);
+		memcpy(cmd_data, cmd_head.addr, cmd_head.addr_len);
 
-		pr_debug("[CMD HEAD DATA] ADDR:0x%02x%02x.", cmd_head.data[0],
-							cmd_head.data[1]);
+		pr_debug("[CMD HEAD DATA] ADDR:0x%02x%02x.", cmd_data[0],
+							cmd_data[1]);
 		pr_debug("[CMD HEAD ADDR] ADDR:0x%02x%02x.", cmd_head.addr[0],
 							cmd_head.addr[1]);
 
@@ -526,13 +523,13 @@ static s32 goodix_tool_read(struct file *file, char __user *user_buf,
 		if (data_len > count)
 			data_len = count;
 
-		if (tool_i2c_read(cmd_head.data, data_len) <= 0) {
+		if (tool_i2c_read(cmd_data, data_len) <= 0) {
 			dev_err(&gt_client->dev, "Read data failed!\n");
 			ret = -EIO;
 			goto exit;
 		}
 		ret = simple_read_from_buffer(user_buf, count, ppos,
-			&cmd_head.data[GTP_ADDR_LENGTH], data_len);
+			&cmd_data[GTP_ADDR_LENGTH], data_len);
 		break;
 	case GTP_RW_FILL_INFO:
 		ret = fill_update_info(user_buf, count, ppos);
@@ -567,13 +564,13 @@ s32 init_wr_node(struct i2c_client *client)
 
 	gt_client = client;
 	memset(&cmd_head, 0, sizeof(cmd_head));
-	cmd_head.data = NULL;
+	cmd_data = NULL;
 
 	i = GTP_I2C_RETRY_5;
-	while ((!cmd_head.data) && i) {
-		cmd_head.data = devm_kzalloc(&client->dev,
+	while ((!cmd_data) && i) {
+		cmd_data = devm_kzalloc(&client->dev,
 				i * DATA_LENGTH_UINT, GFP_KERNEL);
-		if (cmd_head.data)
+		if (cmd_data)
 			break;
 		i--;
 	}

drivers/input/touchscreen/synaptics_dsx_2.6/synaptics_dsx_fw_update.c

@@ -2218,10 +2218,12 @@ static int fwu_get_image_firmware_id(unsigned int *fw_id)
 					__func__);
 			return -ENOMEM;
 		}
-		while (strptr[index] >= '0' && strptr[index] <= '9') {
+		while ((index < MAX_FIRMWARE_ID_LEN - 1) && strptr[index] >= '0'
+						&& strptr[index] <= '9') {
 			firmware_id[index] = strptr[index];
 			index++;
 		}
+		firmware_id[index] = '\0';
 
 		retval = sstrtoul(firmware_id, 10, (unsigned long *)fw_id);
 		kfree(firmware_id);

drivers/input/touchscreen/synaptics_rmi_dev.c

@@ -307,18 +307,26 @@ static ssize_t rmidev_read(struct file *filp, char __user *buf,
 		return -EBADF;
 	}
 
-	if (count == 0)
-		return 0;
+	mutex_lock(&(dev_data->file_mutex));
 
 	if (count > (REG_ADDR_LIMIT - *f_pos))
 		count = REG_ADDR_LIMIT - *f_pos;
 
-	tmpbuf = kzalloc(count + 1, GFP_KERNEL);
-	if (!tmpbuf)
-		return -ENOMEM;
+	if (count == 0) {
+		retval = 0;
+		goto unlock;
+	}
 
-	mutex_lock(&(dev_data->file_mutex));
+	if (*f_pos > REG_ADDR_LIMIT) {
+		retval = -EFAULT;
+		goto unlock;
+	}
 
+	tmpbuf = kzalloc(count + 1, GFP_KERNEL);
+	if (!tmpbuf) {
+		retval = -ENOMEM;
+		goto unlock;
+	}
 	retval = rmidev->fn_ptr->read(rmidev->rmi4_data,
 			*f_pos,
 			tmpbuf,
@@ -332,8 +340,9 @@ static ssize_t rmidev_read(struct file *filp, char __user *buf,
 		*f_pos += retval;
 
 clean_up:
-	mutex_unlock(&(dev_data->file_mutex));
 	kfree(tmpbuf);
+unlock:
+	mutex_unlock(&(dev_data->file_mutex));
 	return retval;
 }
 
@@ -357,32 +366,43 @@ static ssize_t rmidev_write(struct file *filp, const char __user *buf,
 		return -EBADF;
 	}
 
-	if (count == 0)
-		return 0;
+	mutex_lock(&(dev_data->file_mutex));
+
+	if (*f_pos > REG_ADDR_LIMIT) {
+		retval = -EFAULT;
+		goto unlock;
+	}
 
 	if (count > (REG_ADDR_LIMIT - *f_pos))
 		count = REG_ADDR_LIMIT - *f_pos;
 
+	if (count == 0) {
+		retval = 0;
+		goto unlock;
+	}
+
 	tmpbuf = kzalloc(count + 1, GFP_KERNEL);
-	if (!tmpbuf)
-		return -ENOMEM;
+	if (!tmpbuf) {
+		retval = -ENOMEM;
+		goto unlock;
+	}
 
 	if (copy_from_user(tmpbuf, buf, count)) {
-		kfree(tmpbuf);
-		return -EFAULT;
+		retval = -EFAULT;
+		goto clean_up;
 	}
 
-	mutex_lock(&(dev_data->file_mutex));
-
 	retval = rmidev->fn_ptr->write(rmidev->rmi4_data,
 			*f_pos,
 			tmpbuf,
 			count);
 	if (retval >= 0)
 		*f_pos += retval;
 
-	mutex_unlock(&(dev_data->file_mutex));
+clean_up:
 	kfree(tmpbuf);
+unlock:
+	mutex_unlock(&(dev_data->file_mutex));
 	return retval;
 }
 

drivers/media/platform/msm/camera_v2/msm.c

@@ -1104,17 +1104,21 @@ long msm_copy_camera_private_ioctl_args(unsigned long arg,
 	struct msm_camera_private_ioctl_arg *k_ioctl,
 	void __user **tmp_compat_ioctl_ptr)
 {
-	struct msm_camera_private_ioctl_arg *up_ioctl_ptr =
-		(struct msm_camera_private_ioctl_arg *)arg;
+	struct msm_camera_private_ioctl_arg up_ioctl;
 
 	if (WARN_ON(!arg || !k_ioctl || !tmp_compat_ioctl_ptr))
 		return -EIO;
 
-	k_ioctl->id = up_ioctl_ptr->id;
-	k_ioctl->size = up_ioctl_ptr->size;
-	k_ioctl->result = up_ioctl_ptr->result;
-	k_ioctl->reserved = up_ioctl_ptr->reserved;
-	*tmp_compat_ioctl_ptr = compat_ptr(up_ioctl_ptr->ioctl_ptr);
+	if (copy_from_user(&up_ioctl,
+		(struct msm_camera_private_ioctl_arg *)arg,
+		sizeof(struct msm_camera_private_ioctl_arg)))
+		return -EFAULT;
+
+	k_ioctl->id = up_ioctl.id;
+	k_ioctl->size = up_ioctl.size;
+	k_ioctl->result = up_ioctl.result;
+	k_ioctl->reserved = up_ioctl.reserved;
+	*tmp_compat_ioctl_ptr = compat_ptr(up_ioctl.ioctl_ptr);
 
 	return 0;
 }

drivers/media/platform/msm/camera_v2/msm_buf_mgr/msm_generic_buf_mgr.c

@@ -297,8 +297,8 @@ static void msm_buf_mngr_sd_shutdown(struct msm_buf_mngr_device *dev,
 	if (!list_empty(&dev->buf_qhead)) {
 		list_for_each_entry_safe(bufs,
 			save, &dev->buf_qhead, entry) {
-			pr_info("%s: Delete invalid bufs =%lx, session_id=%u, bufs->ses_id=%d, str_id=%d, idx=%d\n",
-				__func__, (unsigned long)bufs, session->session,
+			pr_info("%s: Delete invalid bufs =%pK, session_id=%u, bufs->ses_id=%d, str_id=%d, idx=%d\n",
+				__func__, (void *)bufs, session->session,
 				bufs->session_id, bufs->stream_id,
 				bufs->index);
 			if (session->session == bufs->session_id) {

drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c

@@ -1865,6 +1865,8 @@ static int msm_cpp_check_buf_type(struct msm_buf_mngr_info *buff_mgr_info,
 			/* More or equal bufs as Input buffer */
 			num_output_bufs = new_frame->batch_info.batch_size;
 		}
+		if (num_output_bufs > MSM_OUTPUT_BUF_CNT)
+			return 0;
 		for (i = 0; i < num_output_bufs; i++) {
 			new_frame->output_buffer_info[i].index =
 				buff_mgr_info->user_buf.buf_idx[i];

drivers/misc/qseecom.c

@@ -6987,7 +6987,11 @@ long qseecom_ioctl(struct file *file, unsigned cmd, unsigned long arg)
 			break;
 		}
 		pr_debug("SET_MEM_PARAM: qseecom addr = 0x%pK\n", data);
+		mutex_lock(&app_access_lock);
+		atomic_inc(&data->ioctl_count);
 		ret = qseecom_set_client_mem_param(data, argp);
+		atomic_dec(&data->ioctl_count);
+		mutex_unlock(&app_access_lock);
 		if (ret)
 			pr_err("failed Qqseecom_set_mem_param request: %d\n",
 								ret);