Merge "soc: qcom: rpm-smd-debug: initialize variables and check for return value"

diff --git a/drivers/soc/qcom/rpm-smd-debug.c b/drivers/soc/qcom/rpm-smd-debug.c
index 4e406f7..6ef90b2 100644 (file)
--- a/drivers/soc/qcom/rpm-smd-debug.c
+++ b/drivers/soc/qcom/rpm-smd-debug.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2013-2014, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2013-2014, 2017,  The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -44,9 +44,9 @@ static ssize_t rsc_ops_write(struct file *fp, const char __user *user_buffer,
 {
        char buf[MAX_MSG_BUFFER], rsc_type_str[6] = {}, rpm_set[8] = {},
                                                key_str[6] = {};
-       int i, pos, set = -1, nelems;
+       int i, pos = -1, set = -1, nelems = -1;
        char *cmp;
-       uint32_t rsc_type, rsc_id, key, data;
+       uint32_t rsc_type = 0, rsc_id = 0, key = 0, data = 0;
        struct msm_rpm_request *req;
 
        count = min(count, sizeof(buf) - 1);
@@ -55,8 +55,12 @@ static ssize_t rsc_ops_write(struct file *fp, const char __user *user_buffer,
        buf[count] = '\0';
        cmp = strstrip(buf);
 
-       sscanf(cmp, "%7s %5s %u %d %n", rpm_set, rsc_type_str, &rsc_id,
-                                                       &nelems, &pos);
+       if (sscanf(cmp, "%7s %5s %u %d %n", rpm_set, rsc_type_str,
+                               &rsc_id, &nelems, &pos) != 4) {
+               pr_err("Invalid number of arguments passed\n");
+               goto err;
+       }
+
        if (strlen(rpm_set) > 6 || strlen(rsc_type_str) > 4) {
                pr_err("Invalid value of set or resource type\n");
                goto err;
@@ -84,7 +88,11 @@ static ssize_t rsc_ops_write(struct file *fp, const char __user *user_buffer,
 
        for (i = 0; i < nelems; i++) {
                cmp += pos;
-               sscanf(cmp, "%5s %n", key_str, &pos);
+               if (sscanf(cmp, "%5s %n", key_str, &pos) != 1) {
+                       pr_err("Invalid number of arguments passed\n");
+                       goto err;
+               }
+
                if (strlen(key_str) > 4) {
                        pr_err("Key value cannot be more than 4 charecters");
                        goto err;
@@ -96,7 +104,11 @@ static ssize_t rsc_ops_write(struct file *fp, const char __user *user_buffer,
                }
 
                cmp += pos;
-               sscanf(cmp, "%u %n", &data, &pos);
+               if (sscanf(cmp, "%u %n", &data, &pos) != 1) {
+                       pr_err("Invalid number of arguments passed\n");
+                       goto err;
+               }
+
                if (msm_rpm_add_kvp_data(req, key,
                                (void *)&data, sizeof(data)))
                        goto err_request;