Fix "Security Vulnerability - arbitrary address write ddp_drv.c" issue

Problem:
user input parameter without validation

Solution:
Remove legacy code to prevent buffer overflow

Bug num:28402341

Change-Id: I87a008dbf734c583685577ab9f38bbad0fd49c50
Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com>
(cherry picked from commit 76884c3948a5896c7d724a6852e9f8d1403fa9d0)

2 files changed, 0 insertions, 59 deletions

diff --git a/drivers/misc/mediatek/dispsys/mt6582/ddp_drv.c b/drivers/misc/mediatek/dispsys/mt6582/ddp_drv.c
index 4685c388f648..d4c5b90efd97 100644
--- a/drivers/misc/mediatek/dispsys/mt6582/ddp_drv.c
+++ b/drivers/misc/mediatek/dispsys/mt6582/ddp_drv.c
@@ -1245,28 +1245,6 @@ static long disp_unlocked_ioctl(struct file *file, unsigned int cmd, unsigned lo
     DISP_DBG("cmd=0x%x, arg=0x%x \n", cmd, (unsigned int)arg);
     switch(cmd)
     {
-        case DISP_IOCTL_WRITE_REG:
-
-            if(copy_from_user(&wParams, (void *)arg, sizeof(DISP_WRITE_REG )))
-            {
-                DISP_ERR("DISP_IOCTL_WRITE_REG, copy_from_user failed\n");
-                return -EFAULT;
-            }
-
-            DISP_DBG("write  0x%x = 0x%x (0x%x)\n", wParams.reg, wParams.val, wParams.mask);
-            if(wParams.reg>DISPSYS_REG_ADDR_MAX || wParams.reg<DISPSYS_REG_ADDR_MIN)
-            {
-                DISP_ERR("reg write, addr invalid, addr min=0x%x, max=0x%x, addr=0x%x \n",
-                    DISPSYS_REG_ADDR_MIN,
-                    DISPSYS_REG_ADDR_MAX,
-                    wParams.reg);
-                return -EFAULT;
-            }
-
-            *(volatile unsigned int*)wParams.reg = (*(volatile unsigned int*)wParams.reg & ~wParams.mask) | (wParams.val & wParams.mask);
-            //mt65xx_reg_sync_writel(wParams.reg, value);
-            break;
-
         case DISP_IOCTL_READ_REG:
             if(copy_from_user(&rParams, (void *)arg, sizeof(DISP_READ_REG)))
             {
@@ -1293,40 +1271,6 @@ static long disp_unlocked_ioctl(struct file *file, unsigned int cmd, unsigned lo
             }
             break;
 
-        case DISP_IOCTL_READ_REG_TABLE:
-            if(copy_from_user(&rTableParams, (void *)arg, sizeof(DISP_READ_REG_TABLE)))
-            {
-                DISP_ERR("DISP_IOCTL_READ_REG_TABLE, copy_from_user failed\n");
-                return -EFAULT;
-            }
-
-            #if defined(CONFIG_MTK_HDMI_SUPPORT)
-            if (down_interruptible(&hdmi_update_mutex)) {
-                DISP_ERR("can't get semaphore hdmi_update_mutex\n");
-                return -EFAULT;
-                }
-            #endif
-
-            for (count=0; count<rTableParams.count; count++)
-            {
-                if(rTableParams.reg[count]>DISPSYS_REG_ADDR_MAX || rTableParams.reg[count]<DISPSYS_REG_ADDR_MIN)
-                {
-                    DISP_ERR("reg read, addr invalid, addr min=0x%x, max=0x%x, addr=0x%x \n",
-                        DISPSYS_REG_ADDR_MIN,
-                        DISPSYS_REG_ADDR_MAX,
-                        rTableParams.reg[count]);
-                    continue;
-                }
-
-                rTableParams.val[count] = (*(volatile unsigned int*)rTableParams.reg[count]) & rTableParams.mask[count];
-            }
-
-            #if defined(CONFIG_MTK_HDMI_SUPPORT)
-                up(&hdmi_update_mutex);
-            #endif
-
-            break;
-
         case DISP_IOCTL_WAIT_IRQ:
             if(copy_from_user(&wait_irq_struct, (void*)arg , sizeof(wait_irq_struct)))
             {
diff --git a/drivers/misc/mediatek/dispsys/mt6582/ddp_drv.h b/drivers/misc/mediatek/dispsys/mt6582/ddp_drv.h
index f4ffc588db42..27d44ed096f9 100644
--- a/drivers/misc/mediatek/dispsys/mt6582/ddp_drv.h
+++ b/drivers/misc/mediatek/dispsys/mt6582/ddp_drv.h
@@ -225,7 +225,6 @@ typedef enum
 
 #define DISP_IOCTL_MAGIC        'x'
 
-#define DISP_IOCTL_WRITE_REG       _IOW     (DISP_IOCTL_MAGIC, 1, DISP_WRITE_REG)
 #define DISP_IOCTL_READ_REG        _IOWR    (DISP_IOCTL_MAGIC, 2, DISP_READ_REG)
 #define DISP_IOCTL_WAIT_IRQ        _IOR     (DISP_IOCTL_MAGIC, 3, disp_wait_irq_struct)
 #define DISP_IOCTL_DUMP_REG        _IOR     (DISP_IOCTL_MAGIC, 4, int)
@@ -291,8 +290,6 @@ typedef enum
 #define DISP_IOCTL_SET_PQ_GAL_PARAM     _IOW    (DISP_IOCTL_MAGIC, 59 , DISP_PQ_PARAM)
 #define DISP_IOCTL_GET_PQ_GAL_PARAM     _IOR    (DISP_IOCTL_MAGIC, 60 , DISP_PQ_PARAM)
 
-#define DISP_IOCTL_READ_REG_TABLE       _IOWR    (DISP_IOCTL_MAGIC, 61, DISP_READ_REG_TABLE)
-
 // secure video path implementation: the handle value
 #define DISP_IOCTL_SET_TPLAY_HANDLE    _IOW    (DISP_IOCTL_MAGIC, 62, unsigned int)