auxadc: fix auxadc security defect

[Detail]
auxadc:
1. fix auxadc security defect`

Change-Id: I60eeade13b8ddef14cbc2773d7f6fb9d7e8d49b0
Signed-off-by: Xuexi Bai <xuexi.bai@mediatek.com>
CR-Id: ALPS03353887
Feature: Others
Backported to 3.10
Signed-off-by: Mister Oyster <oysterized@gmail.com>

2 files changed, 40 insertions, 12 deletions

diff --git a/drivers/misc/mediatek/auxadc/mt6735/mt_auxadc_hal.c b/drivers/misc/mediatek/auxadc/mt6735/mt_auxadc_hal.c
index 2ac63ed44..4e661bbb9 100644
--- a/drivers/misc/mediatek/auxadc/mt6735/mt_auxadc_hal.c
+++ b/drivers/misc/mediatek/auxadc/mt6735/mt_auxadc_hal.c
@@ -346,6 +346,16 @@ void mt_auxadc_hal_resume(void)
 
 int mt_auxadc_dump_register(char *buf)
 {
+	if (buf == NULL) {
+		pr_debug("[%s] Invalid input!!\n", __func__);
+		return 0;
+	}
+
+	if (strlen(buf) < 64) {
+		pr_debug("[%s] Invalid input!!\n", __func__);
+		return 0;
+	}
+
 	printk("[auxadc]: AUXADC_CON0=%x\n",AUXADC_DRV_ReadReg16((volatile u16 *)AUXADC_CON0));
 	printk("[auxadc]: AUXADC_CON1=%x\n",AUXADC_DRV_ReadReg16((volatile u16 *)AUXADC_CON1));
 	printk("[auxadc]: AUXADC_CON2=%x\n",AUXADC_DRV_ReadReg16((volatile u16 *)AUXADC_CON2));
diff --git a/drivers/misc/mediatek/auxadc/mt_auxadc.c b/drivers/misc/mediatek/auxadc/mt_auxadc.c
index 476355493..b89dbf132 100644
--- a/drivers/misc/mediatek/auxadc/mt_auxadc.c
+++ b/drivers/misc/mediatek/auxadc/mt_auxadc.c
@@ -890,6 +890,11 @@ static DEVICE_ATTR(AUXADC_Channel_Is_Calibration, 0664, show_AUXADC_Channel_Is_C
 
 static ssize_t show_AUXADC_register(struct device *dev,struct device_attribute *attr, char *buf)
 {
+	if (buf == NULL) {
+		pr_debug("[%s] Invalid input!!\n", __func__);
+		return 0;
+	}
+
     return mt_auxadc_dump_register(buf);
 }
 
@@ -908,7 +913,13 @@ static ssize_t show_AUXADC_chanel(struct device *dev,struct device_attribute *at
 	/* read data */
     int i = 0, data[4] = {0,0,0,0};
     char buf_temp[960];
-    int res =0;
+    int res = 0;
+
+	if (buf == NULL) {
+		pr_debug("[%s] Invalid input!!\n", __func__);
+		return 0;
+	}
+
 	for (i = 0; i < 5; i++) {
 		res = IMM_auxadc_GetOneChannelValue(i,data,NULL);
 		if (res < 0) {
@@ -959,10 +970,8 @@ static int dbug_thread(void *unused)
 
 		}
 	  msleep(500);
-
       }
 	  msleep(500);
-
    }
    return 0;
 }
@@ -971,23 +980,32 @@ static int dbug_thread(void *unused)
 static ssize_t store_AUXADC_channel(struct device *dev, struct device_attribute *attr,
 				    const char *buf, size_t size)
 {
-	unsigned int start_flag;
-	int error;
+	int start_flag = 0;
+	int error = 0;
+	int ret = 0;
 
-		if (sscanf(buf, "%u", &start_flag) != 1) {
-			printk("[adc_driver]: Invalid values\n");
-			return -EINVAL;
-		}
+	if (buf == NULL) {
+		pr_debug("[%s] Invalid input!!\n", __func__);
+		return 0;
+	}
+ 
+	ret = kstrtoint(buf, sizeof(int), &start_flag);
+	if (ret < 0) {
+		pr_debug("[%s] Invalid invalues!!\n", __func__);
+		return 0;
+	}
 
-		printk("[adc_driver] start flag =%d \n",start_flag);
+	pr_debug("[adc_driver] start flag =%d\n", start_flag);
+	if (start_flag) {
 		g_start_debug_thread = start_flag;
-	if (1 == start_flag) {
-		   thread = kthread_run(dbug_thread, 0, "AUXADC");
+		thread = kthread_run(dbug_thread, 0, "AUXADC");
 
 		if (IS_ERR(thread)) {
 			  error = PTR_ERR(thread);
 			  printk( "[adc_driver] failed to create kernel thread: %d\n", error);
 		   }
+	} else {
+		pr_debug("[%s] Invalid input!!\n", __func__);
 		}
 
     return size;