lkml.org 
[lkml]   [2020]   [Nov]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.9 06/14] leds: lm3697: Fix out-of-bound access
    Date
    From: Gabriel David <ultracoolguy@tutanota.com>

    commit 98d278ca00bd8f62c8bc98bd9e65372d16eb6956 upstream

    If both LED banks aren't used in device tree, an out-of-bounds
    condition in lm3697_init occurs because of the for loop assuming that
    all the banks are used. Fix it by adding a variable that contains the
    number of used banks.

    Signed-off-by: Gabriel David <ultracoolguy@tutanota.com>
    [removed extra rename, minor tweaks]
    Signed-off-by: Pavel Machek <pavel@ucw.cz>
    Cc: stable@kernel.org
    [sudip: use client->dev]
    Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/leds/leds-lm3697.c | 8 +++++---
    1 file changed, 5 insertions(+), 3 deletions(-)

    --- a/drivers/leds/leds-lm3697.c
    +++ b/drivers/leds/leds-lm3697.c
    @@ -78,6 +78,7 @@ struct lm3697 {
    struct mutex lock;

    int bank_cfg;
    + int num_banks;

    struct lm3697_led leds[];
    };
    @@ -180,7 +181,7 @@ static int lm3697_init(struct lm3697 *pr
    if (ret)
    dev_err(&priv->client->dev, "Cannot write OUTPUT config\n");

    - for (i = 0; i < LM3697_MAX_CONTROL_BANKS; i++) {
    + for (i = 0; i < priv->num_banks; i++) {
    led = &priv->leds[i];
    ret = ti_lmu_common_set_ramp(&led->lmu_data);
    if (ret)
    @@ -307,8 +308,8 @@ static int lm3697_probe(struct i2c_clien
    int ret;

    count = device_get_child_node_count(&client->dev);
    - if (!count) {
    - dev_err(&client->dev, "LEDs are not defined in device tree!");
    + if (!count || count > LM3697_MAX_CONTROL_BANKS) {
    + dev_err(&client->dev, "Strange device tree!");
    return -ENODEV;
    }

    @@ -322,6 +323,7 @@ static int lm3697_probe(struct i2c_clien

    led->client = client;
    led->dev = &client->dev;
    + led->num_banks = count;
    led->regmap = devm_regmap_init_i2c(client, &lm3697_regmap_config);
    if (IS_ERR(led->regmap)) {
    ret = PTR_ERR(led->regmap);

    \
     
     \ /
      Last update: 2020-11-20 12:09    [W:3.816 / U:1.136 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site