Merge "Raise cam_vana to 3V for OV12870 camera module" into FPIIM_WIP
diff --git a/arch/arm/configs/fairphone-perf_defconfig b/arch/arm/configs/fairphone-perf_defconfig
index f415da9..e4ca03c 100755
--- a/arch/arm/configs/fairphone-perf_defconfig
+++ b/arch/arm/configs/fairphone-perf_defconfig
@@ -507,8 +507,6 @@
 CONFIG_MSM_IOMMU_PMON=y
 CONFIG_IOMMU_PGTABLES_L2=y
 CONFIG_MSM_IOMMU_VBIF_CHECK=y
-CONFIG_MOBICORE_SUPPORT=m
-CONFIG_MOBICORE_API=m
 CONFIG_BIF=y
 CONFIG_BIF_QPNP=y
 CONFIG_EXT2_FS=y
diff --git a/arch/arm/configs/fairphone_defconfig b/arch/arm/configs/fairphone_defconfig
index 57e48654..28354a7 100755
--- a/arch/arm/configs/fairphone_defconfig
+++ b/arch/arm/configs/fairphone_defconfig
@@ -507,8 +507,6 @@
 CONFIG_MSM_IOMMU_PMON=y
 CONFIG_IOMMU_PGTABLES_L2=y
 CONFIG_MSM_IOMMU_VBIF_CHECK=y
-CONFIG_MOBICORE_SUPPORT=m
-CONFIG_MOBICORE_API=m
 CONFIG_CORESIGHT=y
 CONFIG_CORESIGHT_FUSE=y
 CONFIG_CORESIGHT_TMC=y
diff --git a/arch/arm/configs/msm8226-perf_defconfig b/arch/arm/configs/msm8226-perf_defconfig
index f0b7949..a08c584 100644
--- a/arch/arm/configs/msm8226-perf_defconfig
+++ b/arch/arm/configs/msm8226-perf_defconfig
@@ -487,8 +487,6 @@
 CONFIG_CRYPTO_SHA512_ARM_NEON=y
 CONFIG_CRYPTO_AES_ARM_BS=y
 CONFIG_CRYPTO_SHA1_ARM=y
-CONFIG_MOBICORE_SUPPORT=m
-CONFIG_MOBICORE_API=m
 CONFIG_MSM_RPM_RBCPR_STATS_V2_LOG=y
 CONFIG_MSM_RDBG=m
 CONFIG_DEVMEM=n
diff --git a/arch/arm/configs/msm8226_defconfig b/arch/arm/configs/msm8226_defconfig
index 992916f..4d9e5e4 100644
--- a/arch/arm/configs/msm8226_defconfig
+++ b/arch/arm/configs/msm8226_defconfig
@@ -543,8 +543,6 @@
 CONFIG_CRYPTO_DEV_QCRYPTO=m
 CONFIG_CRYPTO_DEV_QCE=y
 CONFIG_CRYPTO_DEV_QCEDEV=m
-CONFIG_MOBICORE_SUPPORT=m
-CONFIG_MOBICORE_API=m
 CONFIG_MSM_RPM_RBCPR_STATS_V2_LOG=y
 CONFIG_MSM_RDBG=m
 CONFIG_NETFILTER_XT_TARGET_IDLETIMER=y
diff --git a/arch/arm/configs/msm8610-perf_defconfig b/arch/arm/configs/msm8610-perf_defconfig
index 931b272..fc00c68 100644
--- a/arch/arm/configs/msm8610-perf_defconfig
+++ b/arch/arm/configs/msm8610-perf_defconfig
@@ -426,8 +426,6 @@
 CONFIG_CRYPTO_MD4=y
 CONFIG_CRYPTO_ARC4=y
 CONFIG_CRYPTO_TWOFISH=y
-CONFIG_MOBICORE_SUPPORT=m
-CONFIG_MOBICORE_API=m
 # CONFIG_CRYPTO_HW is not set
 CONFIG_CRC_CCITT=y
 CONFIG_PPP=y
diff --git a/arch/arm/configs/msm8610_defconfig b/arch/arm/configs/msm8610_defconfig
index 791cb8a..1fe22bf 100644
--- a/arch/arm/configs/msm8610_defconfig
+++ b/arch/arm/configs/msm8610_defconfig
@@ -503,6 +503,4 @@
 CONFIG_SENSORS_MMA8X5X=y
 CONFIG_SENSORS_CAPELLA_CM36283=y
 CONFIG_MSM_RDBG=m
-CONFIG_MOBICORE_SUPPORT=m
-CONFIG_MOBICORE_API=m
 CONFIG_NETFILTER_XT_TARGET_IDLETIMER=y
diff --git a/arch/arm/configs/msm8960-perf_defconfig b/arch/arm/configs/msm8960-perf_defconfig
index fd8245f..29892ca 100644
--- a/arch/arm/configs/msm8960-perf_defconfig
+++ b/arch/arm/configs/msm8960-perf_defconfig
@@ -508,8 +508,6 @@
 CONFIG_MSM_AVTIMER=y
 CONFIG_MSM_IOMMU_V0=y
 CONFIG_IOMMU_PGTABLES_L2=y
-CONFIG_MOBICORE_SUPPORT=m
-CONFIG_MOBICORE_API=m
 CONFIG_CORESIGHT=y
 CONFIG_CORESIGHT_TPIU=y
 CONFIG_CORESIGHT_ETB=y
diff --git a/arch/arm/configs/msm8960_defconfig b/arch/arm/configs/msm8960_defconfig
index c668cb2..55c841d 100644
--- a/arch/arm/configs/msm8960_defconfig
+++ b/arch/arm/configs/msm8960_defconfig
@@ -509,8 +509,6 @@
 CONFIG_SPS_SUPPORT_BAMDMA=y
 CONFIG_MSM_IOMMU_V0=y
 CONFIG_IOMMU_PGTABLES_L2=y
-CONFIG_MOBICORE_SUPPORT=m
-CONFIG_MOBICORE_API=m
 CONFIG_CORESIGHT=y
 CONFIG_CORESIGHT_TPIU=y
 CONFIG_CORESIGHT_ETB=y
diff --git a/arch/arm/configs/msm8974-perf_defconfig b/arch/arm/configs/msm8974-perf_defconfig
index 92fc892..3aac7f6 100755
--- a/arch/arm/configs/msm8974-perf_defconfig
+++ b/arch/arm/configs/msm8974-perf_defconfig
@@ -469,8 +469,6 @@
 CONFIG_MSM_IOMMU_V1=y
 CONFIG_IOMMU_PGTABLES_L2=y
 CONFIG_MSM_IOMMU_VBIF_CHECK=y
-CONFIG_MOBICORE_SUPPORT=m
-CONFIG_MOBICORE_API=m
 CONFIG_BIF=y
 CONFIG_BIF_QPNP=y
 CONFIG_EXT2_FS=y
diff --git a/arch/arm/configs/msm8974_defconfig b/arch/arm/configs/msm8974_defconfig
index 0e255e0..4b7eb88 100755
--- a/arch/arm/configs/msm8974_defconfig
+++ b/arch/arm/configs/msm8974_defconfig
@@ -492,8 +492,6 @@
 CONFIG_MSM_IOMMU_PMON=y
 CONFIG_IOMMU_PGTABLES_L2=y
 CONFIG_MSM_IOMMU_VBIF_CHECK=y
-CONFIG_MOBICORE_SUPPORT=m
-CONFIG_MOBICORE_API=m
 CONFIG_CORESIGHT=y
 CONFIG_CORESIGHT_FUSE=y
 CONFIG_CORESIGHT_TMC=y
diff --git a/arch/arm/mach-msm/qdsp6v2/audio_utils_aio.c b/arch/arm/mach-msm/qdsp6v2/audio_utils_aio.c
index b996d29..615467c 100644
--- a/arch/arm/mach-msm/qdsp6v2/audio_utils_aio.c
+++ b/arch/arm/mach-msm/qdsp6v2/audio_utils_aio.c
@@ -684,7 +684,8 @@
 	struct audio_aio_event *drv_evt = NULL;
 	int timeout;
 	unsigned long flags;
-
+	memset(&usr_evt, 0, sizeof(struct msm_audio_event));
+ 
 	if (copy_from_user(&usr_evt, arg, sizeof(struct msm_audio_event)))
 		return -EFAULT;
 
diff --git a/drivers/crypto/msm/qcedev.c b/drivers/crypto/msm/qcedev.c
index d05bc92..7960af5 100755
--- a/drivers/crypto/msm/qcedev.c
+++ b/drivers/crypto/msm/qcedev.c
@@ -1828,6 +1828,12 @@
 		err = qcedev_hash_final(&qcedev_areq, handle);
 		if (err)
 			return err;
+
+		if (handle->sha_ctxt.diglen > QCEDEV_MAX_SHA_DIGEST) {
+			pr_err("Invalid sha_ctxt.diglen %d\n",
+					handle->sha_ctxt.diglen);
+			return -EINVAL;
+		}
 		qcedev_areq.sha_op_req.diglen = handle->sha_ctxt.diglen;
 		memcpy(&qcedev_areq.sha_op_req.digest[0],
 				&handle->sha_ctxt.digest[0],
@@ -1856,6 +1862,12 @@
 		err = qcedev_hash_final(&qcedev_areq, handle);
 		if (err)
 			return err;
+
+		if (handle->sha_ctxt.diglen > QCEDEV_MAX_SHA_DIGEST) {
+			pr_err("Invalid sha_ctxt.diglen %d\n",
+					handle->sha_ctxt.diglen);
+			return -EINVAL;
+		}
 		qcedev_areq.sha_op_req.diglen =	handle->sha_ctxt.diglen;
 		memcpy(&qcedev_areq.sha_op_req.digest[0],
 				&handle->sha_ctxt.digest[0],
diff --git a/drivers/gpu/msm/kgsl.c b/drivers/gpu/msm/kgsl.c
index d697f06..52e7102 100644
--- a/drivers/gpu/msm/kgsl.c
+++ b/drivers/gpu/msm/kgsl.c
@@ -2610,9 +2610,10 @@
 	/* Commit the pointer to the context in context_idr */
 	write_lock(&device->context_lock);
 	idr_replace(&device->context_idr, context, context->id);
+	param->drawctxt_id = context->id;
 	write_unlock(&device->context_lock);
 
-	param->drawctxt_id = context->id;
+
 done:
 	kgsl_mutex_unlock(&device->mutex, &device->mutex_owner);
 	return result;
diff --git a/drivers/platform/msm/ipa/ipa_rt.c b/drivers/platform/msm/ipa/ipa_rt.c
index 7371d22..e62824b 100644
--- a/drivers/platform/msm/ipa/ipa_rt.c
+++ b/drivers/platform/msm/ipa/ipa_rt.c
@@ -937,6 +937,10 @@
 	mutex_lock(&ipa_ctx->lock);
 	entry = __ipa_add_rt_tbl(lookup->ip, lookup->name);
 	if (entry && entry->cookie == IPA_COOKIE) {
+		if (entry->ref_cnt == ((u32)~0U)) {
+			IPAERR("fail: ref count crossed limit\n");
+			goto ret;
+		}
 		entry->ref_cnt++;
 		lookup->hdl = (uint32_t)entry;
 
@@ -946,6 +950,7 @@
 
 		result = 0;
 	}
+ret:
 	mutex_unlock(&ipa_ctx->lock);
 
 	return result;