Loading drivers/soc/qcom/rpm-smd-debug.c +19 −7 Original line number Diff line number Diff line /* Copyright (c) 2013-2014, The Linux Foundation. All rights reserved. /* Copyright (c) 2013-2014, 2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and Loading Loading @@ -44,9 +44,9 @@ static ssize_t rsc_ops_write(struct file *fp, const char __user *user_buffer, { char buf[MAX_MSG_BUFFER], rsc_type_str[6] = {}, rpm_set[8] = {}, key_str[6] = {}; int i, pos, set = -1, nelems; int i, pos = -1, set = -1, nelems = -1; char *cmp; uint32_t rsc_type, rsc_id, key, data; uint32_t rsc_type = 0, rsc_id = 0, key = 0, data = 0; struct msm_rpm_request *req; count = min(count, sizeof(buf) - 1); Loading @@ -55,8 +55,12 @@ static ssize_t rsc_ops_write(struct file *fp, const char __user *user_buffer, buf[count] = '\0'; cmp = strstrip(buf); sscanf(cmp, "%7s %5s %u %d %n", rpm_set, rsc_type_str, &rsc_id, &nelems, &pos); if (sscanf(cmp, "%7s %5s %u %d %n", rpm_set, rsc_type_str, &rsc_id, &nelems, &pos) != 4) { pr_err("Invalid number of arguments passed\n"); goto err; } if (strlen(rpm_set) > 6 || strlen(rsc_type_str) > 4) { pr_err("Invalid value of set or resource type\n"); goto err; Loading Loading @@ -84,7 +88,11 @@ static ssize_t rsc_ops_write(struct file *fp, const char __user *user_buffer, for (i = 0; i < nelems; i++) { cmp += pos; sscanf(cmp, "%5s %n", key_str, &pos); if (sscanf(cmp, "%5s %n", key_str, &pos) != 1) { pr_err("Invalid number of arguments passed\n"); goto err; } if (strlen(key_str) > 4) { pr_err("Key value cannot be more than 4 charecters"); goto err; Loading @@ -96,7 +104,11 @@ static ssize_t rsc_ops_write(struct file *fp, const char __user *user_buffer, } cmp += pos; sscanf(cmp, "%u %n", &data, &pos); if (sscanf(cmp, "%u %n", &data, &pos) != 1) { pr_err("Invalid number of arguments passed\n"); goto err; } if (msm_rpm_add_kvp_data(req, key, (void *)&data, sizeof(data))) goto err_request; Loading Loading
drivers/soc/qcom/rpm-smd-debug.c +19 −7 Original line number Diff line number Diff line /* Copyright (c) 2013-2014, The Linux Foundation. All rights reserved. /* Copyright (c) 2013-2014, 2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and Loading Loading @@ -44,9 +44,9 @@ static ssize_t rsc_ops_write(struct file *fp, const char __user *user_buffer, { char buf[MAX_MSG_BUFFER], rsc_type_str[6] = {}, rpm_set[8] = {}, key_str[6] = {}; int i, pos, set = -1, nelems; int i, pos = -1, set = -1, nelems = -1; char *cmp; uint32_t rsc_type, rsc_id, key, data; uint32_t rsc_type = 0, rsc_id = 0, key = 0, data = 0; struct msm_rpm_request *req; count = min(count, sizeof(buf) - 1); Loading @@ -55,8 +55,12 @@ static ssize_t rsc_ops_write(struct file *fp, const char __user *user_buffer, buf[count] = '\0'; cmp = strstrip(buf); sscanf(cmp, "%7s %5s %u %d %n", rpm_set, rsc_type_str, &rsc_id, &nelems, &pos); if (sscanf(cmp, "%7s %5s %u %d %n", rpm_set, rsc_type_str, &rsc_id, &nelems, &pos) != 4) { pr_err("Invalid number of arguments passed\n"); goto err; } if (strlen(rpm_set) > 6 || strlen(rsc_type_str) > 4) { pr_err("Invalid value of set or resource type\n"); goto err; Loading Loading @@ -84,7 +88,11 @@ static ssize_t rsc_ops_write(struct file *fp, const char __user *user_buffer, for (i = 0; i < nelems; i++) { cmp += pos; sscanf(cmp, "%5s %n", key_str, &pos); if (sscanf(cmp, "%5s %n", key_str, &pos) != 1) { pr_err("Invalid number of arguments passed\n"); goto err; } if (strlen(key_str) > 4) { pr_err("Key value cannot be more than 4 charecters"); goto err; Loading @@ -96,7 +104,11 @@ static ssize_t rsc_ops_write(struct file *fp, const char __user *user_buffer, } cmp += pos; sscanf(cmp, "%u %n", &data, &pos); if (sscanf(cmp, "%u %n", &data, &pos) != 1) { pr_err("Invalid number of arguments passed\n"); goto err; } if (msm_rpm_add_kvp_data(req, key, (void *)&data, sizeof(data))) goto err_request; Loading