diff options
Diffstat (limited to 'drivers/soc/qcom/rpm-smd-debug.c')
-rw-r--r-- | drivers/soc/qcom/rpm-smd-debug.c | 26 |
1 files changed, 19 insertions, 7 deletions
diff --git a/drivers/soc/qcom/rpm-smd-debug.c b/drivers/soc/qcom/rpm-smd-debug.c index 4e406f7cd379..6ef90b23aed5 100644 --- a/drivers/soc/qcom/rpm-smd-debug.c +++ b/drivers/soc/qcom/rpm-smd-debug.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2013-2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2013-2014, 2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -44,9 +44,9 @@ static ssize_t rsc_ops_write(struct file *fp, const char __user *user_buffer, { char buf[MAX_MSG_BUFFER], rsc_type_str[6] = {}, rpm_set[8] = {}, key_str[6] = {}; - int i, pos, set = -1, nelems; + int i, pos = -1, set = -1, nelems = -1; char *cmp; - uint32_t rsc_type, rsc_id, key, data; + uint32_t rsc_type = 0, rsc_id = 0, key = 0, data = 0; struct msm_rpm_request *req; count = min(count, sizeof(buf) - 1); @@ -55,8 +55,12 @@ static ssize_t rsc_ops_write(struct file *fp, const char __user *user_buffer, buf[count] = '\0'; cmp = strstrip(buf); - sscanf(cmp, "%7s %5s %u %d %n", rpm_set, rsc_type_str, &rsc_id, - &nelems, &pos); + if (sscanf(cmp, "%7s %5s %u %d %n", rpm_set, rsc_type_str, + &rsc_id, &nelems, &pos) != 4) { + pr_err("Invalid number of arguments passed\n"); + goto err; + } + if (strlen(rpm_set) > 6 || strlen(rsc_type_str) > 4) { pr_err("Invalid value of set or resource type\n"); goto err; @@ -84,7 +88,11 @@ static ssize_t rsc_ops_write(struct file *fp, const char __user *user_buffer, for (i = 0; i < nelems; i++) { cmp += pos; - sscanf(cmp, "%5s %n", key_str, &pos); + if (sscanf(cmp, "%5s %n", key_str, &pos) != 1) { + pr_err("Invalid number of arguments passed\n"); + goto err; + } + if (strlen(key_str) > 4) { pr_err("Key value cannot be more than 4 charecters"); goto err; @@ -96,7 +104,11 @@ static ssize_t rsc_ops_write(struct file *fp, const char __user *user_buffer, } cmp += pos; - sscanf(cmp, "%u %n", &data, &pos); + if (sscanf(cmp, "%u %n", &data, &pos) != 1) { + pr_err("Invalid number of arguments passed\n"); + goto err; + } + if (msm_rpm_add_kvp_data(req, key, (void *)&data, sizeof(data))) goto err_request; |