Merge mediatek security patches

* Revert : Merge mediatek security patches (14326e25d3fc3b4d780c2d9d2eebbe3231ad5376)
* Reapply : 14326e25d3fc3b4d780c2d9d2eebbe3231ad5376

Signed-off-by: Mister Oyster <oysterized@gmail.com>

1 files changed, 10 insertions, 9 deletions

diff --git a/drivers/misc/mediatek/i2c/mt6735/i2c_common.c b/drivers/misc/mediatek/i2c/mt6735/i2c_common.c
index 11d97ceb4..050fb32e3 100644
--- a/drivers/misc/mediatek/i2c/mt6735/i2c_common.c
+++ b/drivers/misc/mediatek/i2c/mt6735/i2c_common.c
@@ -44,11 +44,11 @@ int string2hex(const char * buffer, int cnt){
   return c;
 }
 
-char * get_hexbuffer(char *data_buffer, char *hex_buffer)
+char * get_hexbuffer(char *data_buffer, char *hex_buffer, int str_len)
 {
   char * ptr = data_buffer;
   int index = 0;
-  while (*ptr && *++ptr) {
+  while (*ptr && *++ptr && str_len--) {
     *(hex_buffer + index++) = string2hex(ptr-1, 2);
     ptr++;
   }
@@ -213,6 +213,7 @@ static ssize_t set_config(struct device *dev, struct device_attribute *attr, con
   int trans_auxlen;
   int dir=0;
 
+  int data_len;
   int number = 0;
   int length = 0;
   unsigned int ext_flag = 0;
@@ -224,9 +225,10 @@ static ssize_t set_config(struct device *dev, struct device_attribute *attr, con
   unsigned char tmpbuffer[128];
   printk("%s\n", buf);
   //if ( sscanf(buf, "%d %d %d %d %d %d %d %d %d %d %d %d %s", &bus_id, &address, &operation, &trans_mode, &trans_stop, &speed_mode, &pushpull_mode, &query_mode, &timing, &trans_num, &trans_auxlen,&dir, data_buffer) ) {
-  if ( sscanf(buf, "%d %x %d %d %d %d %d %d %d %d %d %s", &bus_id, &address, &operation, &trans_mode, &trans_stop, &speed_mode, &pushpull_mode, &query_mode, &timing, &trans_num, &trans_auxlen,data_buffer) ) {
+  if ( sscanf(buf, "%d %x %d %d %d %d %d %d %d %d %d %d %1023s", &bus_id, &address, &operation, &trans_mode, &trans_stop, &speed_mode, &pushpull_mode, &query_mode, &timing, &trans_num, &trans_auxlen, &data_len, data_buffer) ) {
       if((address != 0)&&(operation<=2)){
-        length = strlen(data_buffer);
+        /* data_len is transfer bytes, offset address + write data */
+        length = 2 * data_len;
       if (operation == 0){
         ext_flag |= I2C_WR_FLAG;
         number = (trans_auxlen << 8) | (length >> 1); ///TODO:need to confitm 8 Or 16
@@ -297,14 +299,14 @@ static ssize_t set_config(struct device *dev, struct device_attribute *attr, con
 
       if (trans_mode == 1) {/*DMA MODE*/
 	  	/*need GFP_DMA32 flag to confirm DMA alloc PA is 32bit range*/
-        vir_addr = dma_alloc_coherent(dev, length >> 1,  &dma_addr, GFP_KERNEL|GFP_DMA32);
+        vir_addr = dma_alloc_coherent(dev, (length >> 1) + 1,  &dma_addr, GFP_KERNEL|GFP_DMA32);
         if ( vir_addr == NULL ){
 
           printk("alloc dma memory failed\n");
           goto err;
         }
       } else {
-        vir_addr = kzalloc(length >> 1, GFP_KERNEL);
+        vir_addr = kzalloc((length >> 1) + 1, GFP_KERNEL);
         if ( vir_addr == NULL){
 
           printk("alloc virtual memory failed\n");
@@ -312,7 +314,7 @@ static ssize_t set_config(struct device *dev, struct device_attribute *attr, con
         }
       }
 
-      get_hexbuffer(data_buffer, vir_addr);
+      get_hexbuffer(data_buffer, vir_addr, length);
       printk(KERN_ALERT"bus_id:%d,address:%x,count:%x,ext_flag:0x%x,timing:%d\n", bus_id,address,number,ext_flag,timing);
       printk(KERN_ALERT"data_buffer:%s\n", data_buffer);
 
@@ -416,7 +418,7 @@ static DEVICE_ATTR(ut, 660, show_config, set_config);
 static int i2c_common_probe(struct platform_device *pdev)
 {
   int ret = 0;
-  //your code here£¬your should save client in your own way
+  //your code here should save client in your own way
   printk(KERN_ALERT"i2c_common device probe\n");
   ret = device_create_file(&pdev->dev, &dev_attr_ut);
   return ret;
@@ -469,4 +471,3 @@ module_exit( xxx_exit);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("MediaTek I2C Bus Driver Test Driver");
 MODULE_AUTHOR("Ranran Lu");
-