Security patches

Signed-off-by: Mister Oyster <oysterized@gmail.com>

9 files changed, 20 insertions, 4 deletions

diff --git a/drivers/misc/mediatek/power/mt6735/ncp1854.c b/drivers/misc/mediatek/power/mt6735/ncp1854.c
index 5956feebe..333e8609c 100644
--- a/drivers/misc/mediatek/power/mt6735/ncp1854.c
+++ b/drivers/misc/mediatek/power/mt6735/ncp1854.c
@@ -689,6 +689,9 @@ static int __init ncp1854_init(void)
 
 static void __exit ncp1854_exit(void)
 {
+    if (new_client != NULL)
+        kfree(new_client);
+
     i2c_del_driver(&ncp1854_driver);
 }
 
diff --git a/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_amddulthro.c b/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_amddulthro.c
index 418bf63d8..b27329601 100644
--- a/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_amddulthro.c
+++ b/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_amddulthro.c
@@ -553,6 +553,8 @@ ssize_t amddulthro_pid_write(struct file *file, const char __user *buf, size_t l
 	int ret = 0;
 	char tmp[MAX_LEN] = {0};
 
+	len = (len < (MAX_LEN-1)) ? len : MAX_LEN-1;
+
 	/* write data to the buffer */
 	if ( copy_from_user(tmp, buf, len) ) {
 		return -EFAULT;
diff --git a/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_amdtxctrl.c b/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_amdtxctrl.c
index 4bf8f6aad..4f7b628a7 100644
--- a/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_amdtxctrl.c
+++ b/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_amdtxctrl.c
@@ -541,6 +541,8 @@ ssize_t amdtxctrl_pid_write( struct file *filp, const char __user *buf, unsigned
 	int ret = 0;
 	char tmp[MAX_LEN] = {0};
 
+	len = (len < (MAX_LEN-1)) ? len : MAX_LEN-1;
+
 	/* write data to the buffer */
 	if ( copy_from_user(tmp, buf, len) ) {
 		return -EFAULT;
diff --git a/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_bcct.c b/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_bcct.c
index 62734a885..487abdaf6 100644
--- a/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_bcct.c
+++ b/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_bcct.c
@@ -320,6 +320,8 @@ static ssize_t _cl_bcct_write(struct file *filp, const char __user *buf, size_t
 	char tmp[128] = {0};
 	int klog_on, limit0, limit1, limit2;
 
+	len = (len < (128 - 1)) ? len : (128 - 1);
+
 	/* write data to the buffer */
 	if ( copy_from_user(tmp, buf, len) ) {
 		return -EFAULT;
diff --git a/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_mdulthro.c b/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_mdulthro.c
index 5b45933d3..fbfe3d9a3 100644
--- a/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_mdulthro.c
+++ b/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_mdulthro.c
@@ -773,6 +773,8 @@ ssize_t mdulthro_pid_write( struct file *filp, const char __user *buf, unsigned
 	int ret = 0;
 	char tmp[MAX_LEN] = {0};
 
+	len = (len < (MAX_LEN-1)) ? len : MAX_LEN-1;
+
 	/* write data to the buffer */
 	if ( copy_from_user(tmp, buf, len) ) {
 		return -EFAULT;
diff --git a/drivers/misc/mediatek/thermal/mt6735/mtk_ts_wmt.c b/drivers/misc/mediatek/thermal/mt6735/mtk_ts_wmt.c
index 2997a5446..bc9f20a5b 100644
--- a/drivers/misc/mediatek/thermal/mt6735/mtk_ts_wmt.c
+++ b/drivers/misc/mediatek/thermal/mt6735/mtk_ts_wmt.c
@@ -891,9 +891,6 @@ ssize_t wmt_wifi_algo_write(struct file *filp, const char __user *buf, size_t le
 
 	len = (len < (sizeof(desc) - 1)) ? len : (sizeof(desc) - 1);
 
-	if (len >= MAX_LEN-1)
-		len = MAX_LEN-1;
-
 	/* write data to the buffer */
 	if (copy_from_user(desc, buf, len)) {
 		return -EFAULT;
@@ -1008,6 +1005,8 @@ ssize_t wmt_tm_pid_write(struct file *filp, const char __user *buf, size_t len,
 	int ret = 0;
 	char tmp[MAX_LEN] = {0};
 
+	len = (len < (MAX_LEN - 1)) ? len : (MAX_LEN - 1);
+
 	/* write data to the buffer */
 	if ( copy_from_user(tmp, buf, len) ) {
 		return -EFAULT;
diff --git a/drivers/misc/mediatek/thermal/mt6735/tm_nth.c b/drivers/misc/mediatek/thermal/mt6735/tm_nth.c
index 72e55d701..d9fa1e3a9 100644
--- a/drivers/misc/mediatek/thermal/mt6735/tm_nth.c
+++ b/drivers/misc/mediatek/thermal/mt6735/tm_nth.c
@@ -193,6 +193,8 @@ static ssize_t _cl_tm_nth_write(struct file *filp, const char __user *buf, size_
 	int tmp_NTHNTHTHRESENTER, tmp_NTHNTHTHRESEXIT, tmp_CPULOADSMASAMPLECNT, tmp_TGTTEMP, tmp_KPINIT, tmp_KIINIT, tmp_KDINIT, tmp_NTHPOLLINGINTERVAL;
 	int tmp_CPU_POWER_LIMIT0, tmp_CPU_POWER_LIMIT1, tmp_CPU_POWER_LIMIT2, tmp_CPU_POWER_LIMIT3, tmp_CPU_POWER_LIMIT4, tmp_CPU_POWER_LIMIT5, tmp_CPU_POWER_LIMIT6;
 
+	len = (len < (sizeof(tmp) - 1)) ? len : (sizeof(tmp) - 1);
+
 	/* write data to the buffer */
 	if ( copy_from_user(tmp, buf, len) ) {
 		return -EFAULT;
diff --git a/drivers/misc/mediatek/thermal/mtk_cooler_shutdown.c b/drivers/misc/mediatek/thermal/mtk_cooler_shutdown.c
index dc5fe0a0e..0a3a474a8 100644
--- a/drivers/misc/mediatek/thermal/mtk_cooler_shutdown.c
+++ b/drivers/misc/mediatek/thermal/mtk_cooler_shutdown.c
@@ -121,6 +121,8 @@ static ssize_t _mtk_cl_sd_pid_write(struct file *filp, const char __user *buf, s
 	int ret = 0;
 	char tmp[MAX_LEN] = { 0 };
 
+	len = (len < (MAX_LEN-1)) ? len : MAX_LEN-1;
+
 	/* write data to the buffer */
 	if (copy_from_user(tmp, buf, len)) {
 		return -EFAULT;
@@ -166,6 +168,8 @@ static ssize_t _mtk_cl_sd_debouncet_write(struct file *filp, const char __user *
 	char desc[MAX_LEN] = {0};
 	int tmp_dbt = -1;
 
+	len = (len < (MAX_LEN-1)) ? len : MAX_LEN-1;
+
 	/* write data to the buffer */
 	if (copy_from_user(desc, buf, len)) {
 		return -EFAULT;
diff --git a/drivers/misc/mediatek/videocodec/mt6735/videocodec_kernel_driver_D3.c b/drivers/misc/mediatek/videocodec/mt6735/videocodec_kernel_driver_D3.c
index 934f2577d..2bc7b0514 100644
--- a/drivers/misc/mediatek/videocodec/mt6735/videocodec_kernel_driver_D3.c
+++ b/drivers/misc/mediatek/videocodec/mt6735/videocodec_kernel_driver_D3.c
@@ -1424,7 +1424,7 @@ static long vcodec_unlocked_ioctl(struct file *file, unsigned int cmd, unsigned
         case VCODEC_GET_CPU_LOADING_INFO:
         {
             VAL_UINT8_T *user_data_addr;
-            VAL_VCODEC_CPU_LOADING_INFO_T _temp;
+            VAL_VCODEC_CPU_LOADING_INFO_T _temp = {0};
 
             MFV_LOGD("VCODEC_GET_CPU_LOADING_INFO +\n");
             user_data_addr = (VAL_UINT8_T *)arg;