From 16f3ec80a103dac081ab859bfc2149d82f768cd9 Mon Sep 17 00:00:00 2001
From: Yong Qin <yong.qin@amlogic.com>
Date: Thu, 30 Aug 2018 18:05:31 +0800
Subject: [PATCH] hdmi: cec: cmd interface cause system crash

PD#172867: cec: cmd interface cause system crash

	1.cmd file interface will cause system crash
	when send data more than 4 bytes

Change-Id: I57035a17138df6c8929d0879068ea095463c128e
Signed-off-by: Yong Qin <yong.qin@amlogic.com>
---
 drivers/amlogic/cec/hdmi_ao_cec.c | 19 +++++++++++++++----
 drivers/amlogic/cec/hdmi_ao_cec.h |  2 +-
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/drivers/amlogic/cec/hdmi_ao_cec.c b/drivers/amlogic/cec/hdmi_ao_cec.c
index 8938d1b350df..9722df761056 100644
--- a/drivers/amlogic/cec/hdmi_ao_cec.c
+++ b/drivers/amlogic/cec/hdmi_ao_cec.c
@@ -1987,14 +1987,25 @@ static ssize_t dbg_en_store(struct class *cla, struct class_attribute *attr,
 static ssize_t cmd_store(struct class *cla, struct class_attribute *attr,
 	const char *bu, size_t count)
 {
-	char buf[6] = {};
+	char buf[20] = {};
+	int tmpbuf[20] = {};
+	int i;
 	int cnt;
 
-	cnt = sscanf(bu, "%x %x %x %x %x %x",
-		    (int *)&buf[0], (int *)&buf[1], (int *)&buf[2],
-		    (int *)&buf[3], (int *)&buf[4], (int *)&buf[5]);
+	cnt = sscanf(bu, "%x %x %x %x %x %x %x %x %x %x %x %x %x %x %x %x",
+		    &tmpbuf[0], &tmpbuf[1], &tmpbuf[2], &tmpbuf[3],
+		    &tmpbuf[4], &tmpbuf[5], &tmpbuf[6], &tmpbuf[7],
+		    &tmpbuf[8], &tmpbuf[9], &tmpbuf[10], &tmpbuf[11],
+		    &tmpbuf[12], &tmpbuf[13], &tmpbuf[14], &tmpbuf[15]);
 	if (cnt < 0)
 		return -EINVAL;
+	if (cnt > 16)
+		cnt = 16;
+
+	for (i = 0; i < cnt; i++)
+		buf[i] = (char)tmpbuf[i];
+
+	/*CEC_ERR("cnt=%d\n", cnt);*/
 	cec_ll_tx(buf, cnt);
 	return count;
 }
diff --git a/drivers/amlogic/cec/hdmi_ao_cec.h b/drivers/amlogic/cec/hdmi_ao_cec.h
index 6fc8b9591349..e9e5bf883179 100644
--- a/drivers/amlogic/cec/hdmi_ao_cec.h
+++ b/drivers/amlogic/cec/hdmi_ao_cec.h
@@ -18,7 +18,7 @@
 #ifndef __AO_CEC_H__
 #define __AO_CEC_H__
 
-#define CEC_DRIVER_VERSION	"Ver 2018/08/13\n"
+#define CEC_DRIVER_VERSION	"Ver 2018/08/30\n"
 
 #define CEC_FRAME_DELAY		msecs_to_jiffies(400)
 #define CEC_DEV_NAME		"cec"