Merge changes Ife01372b,I601bb37d,I4dd73872,I957c1095 into mnc-dr-dev-qcom-lego
* changes:
crypto: msm: Fix several race condition issues in crypto drivers
ASoC: msm: qdsp6v2: add size check to fix out of bounds issue
compat_qcedev: Fix accessing userspace memory in kernel space
msm: camera: sensor:validating the flash initialization parameters
diff --git a/drivers/video/msm/mdss/mdss_mdp_overlay.c b/drivers/video/msm/mdss/mdss_mdp_overlay.c
index ee9bfdd..be12e6c 100644
--- a/drivers/video/msm/mdss/mdss_mdp_overlay.c
+++ b/drivers/video/msm/mdss/mdss_mdp_overlay.c
@@ -4020,11 +4020,14 @@
break;
case metadata_op_get_ion_fd:
if (mfd->fb_ion_handle) {
+ get_dma_buf(mfd->fbmem_buf);
metadata->data.fbmem_ionfd =
dma_buf_fd(mfd->fbmem_buf, 0);
- if (metadata->data.fbmem_ionfd < 0)
+ if (metadata->data.fbmem_ionfd < 0) {
+ dma_buf_put(mfd->fbmem_buf);
pr_err("fd allocation failed. fd = %d\n",
metadata->data.fbmem_ionfd);
+ }
}
break;
case metadata_op_crc:
diff --git a/drivers/video/msm/mdss/mdss_mdp_pp.c b/drivers/video/msm/mdss/mdss_mdp_pp.c
index 4ddab83..7e4d8b2 100644
--- a/drivers/video/msm/mdss/mdss_mdp_pp.c
+++ b/drivers/video/msm/mdss/mdss_mdp_pp.c
@@ -432,7 +432,7 @@
struct mdp_hist_lut_data enhist_disp_cfg[MDSS_BLOCK_DISP_NUM];
struct mdp_dither_cfg_data dither_disp_cfg[MDSS_BLOCK_DISP_NUM];
struct mdp_gamut_cfg_data gamut_disp_cfg[MDSS_BLOCK_DISP_NUM];
- uint16_t gamut_tbl[MDSS_BLOCK_DISP_NUM][GAMUT_TOTAL_TABLE_SIZE];
+ uint16_t gamut_tbl[MDSS_BLOCK_DISP_NUM][3 * GAMUT_TOTAL_TABLE_SIZE];
u32 hist_data[MDSS_BLOCK_DISP_NUM][HIST_V_SIZE];
struct pp_sts_type pp_disp_sts[MDSS_MAX_MIXER_DISP_NUM];
/* physical info */
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 422d8bd..154a123 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -657,6 +657,9 @@
newnp = inet6_sk(newsk);
memcpy(newnp, np, sizeof(struct ipv6_pinfo));
+ newnp->ipv6_mc_list = NULL;
+ newnp->ipv6_ac_list = NULL;
+ newnp->ipv6_fl_list = NULL;
/* Initialize sk's sport, dport, rcv_saddr and daddr for getsockname()
* and getpeername().
