Merge "soc: qcom: rpm-smd-debug: initialize variables and check for return value"

1 files changed, 19 insertions, 7 deletions

diff --git a/drivers/soc/qcom/rpm-smd-debug.c b/drivers/soc/qcom/rpm-smd-debug.c
index 4e406f7cd379..6ef90b23aed5 100644
--- a/drivers/soc/qcom/rpm-smd-debug.c
+++ b/drivers/soc/qcom/rpm-smd-debug.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2013-2014, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2013-2014, 2017,  The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -44,9 +44,9 @@ static ssize_t rsc_ops_write(struct file *fp, const char __user *user_buffer,
 {
 	char buf[MAX_MSG_BUFFER], rsc_type_str[6] = {}, rpm_set[8] = {},
 						key_str[6] = {};
-	int i, pos, set = -1, nelems;
+	int i, pos = -1, set = -1, nelems = -1;
 	char *cmp;
-	uint32_t rsc_type, rsc_id, key, data;
+	uint32_t rsc_type = 0, rsc_id = 0, key = 0, data = 0;
 	struct msm_rpm_request *req;
 
 	count = min(count, sizeof(buf) - 1);
@@ -55,8 +55,12 @@ static ssize_t rsc_ops_write(struct file *fp, const char __user *user_buffer,
 	buf[count] = '\0';
 	cmp = strstrip(buf);
 
-	sscanf(cmp, "%7s %5s %u %d %n", rpm_set, rsc_type_str, &rsc_id,
-							&nelems, &pos);
+	if (sscanf(cmp, "%7s %5s %u %d %n", rpm_set, rsc_type_str,
+				&rsc_id, &nelems, &pos) != 4) {
+		pr_err("Invalid number of arguments passed\n");
+		goto err;
+	}
+
 	if (strlen(rpm_set) > 6 || strlen(rsc_type_str) > 4) {
 		pr_err("Invalid value of set or resource type\n");
 		goto err;
@@ -84,7 +88,11 @@ static ssize_t rsc_ops_write(struct file *fp, const char __user *user_buffer,
 
 	for (i = 0; i < nelems; i++) {
 		cmp += pos;
-		sscanf(cmp, "%5s %n", key_str, &pos);
+		if (sscanf(cmp, "%5s %n", key_str, &pos) != 1) {
+			pr_err("Invalid number of arguments passed\n");
+			goto err;
+		}
+
 		if (strlen(key_str) > 4) {
 			pr_err("Key value cannot be more than 4 charecters");
 			goto err;
@@ -96,7 +104,11 @@ static ssize_t rsc_ops_write(struct file *fp, const char __user *user_buffer,
 		}
 
 		cmp += pos;
-		sscanf(cmp, "%u %n", &data, &pos);
+		if (sscanf(cmp, "%u %n", &data, &pos) != 1) {
+			pr_err("Invalid number of arguments passed\n");
+			goto err;
+		}
+
 		if (msm_rpm_add_kvp_data(req, key,
 				(void *)&data, sizeof(data)))
 			goto err_request;