Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

leds: lm3697: Fix out-of-bound access

If both LED banks aren't used in device tree, an out-of-bounds
condition in lm3697_init occurs because of the for loop assuming that
all the banks are used. Fix it by adding a variable that contains the
number of used banks.

Signed-off-by: Gabriel David <ultracoolguy@tutanota.com>
[removed extra rename, minor tweaks]
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Cc: stable@kernel.org

authored by

Gabriel David and committed by
Pavel Machek
98d278ca 8fd8f942

+5 -3
+5 -3
drivers/leds/leds-lm3697.c
··· 78 78 struct mutex lock; 79 79 80 80 int bank_cfg; 81 + int num_banks; 81 82 82 83 struct lm3697_led leds[]; 83 84 }; ··· 181 180 if (ret) 182 181 dev_err(dev, "Cannot write OUTPUT config\n"); 183 182 184 - for (i = 0; i < LM3697_MAX_CONTROL_BANKS; i++) { 183 + for (i = 0; i < priv->num_banks; i++) { 185 184 led = &priv->leds[i]; 186 185 ret = ti_lmu_common_set_ramp(&led->lmu_data); 187 186 if (ret) ··· 302 301 int ret; 303 302 304 303 count = device_get_child_node_count(dev); 305 - if (!count) { 306 - dev_err(dev, "LEDs are not defined in device tree!"); 304 + if (!count || count > LM3697_MAX_CONTROL_BANKS) { 305 + dev_err(dev, "Strange device tree!"); 307 306 return -ENODEV; 308 307 } 309 308 ··· 316 315 317 316 led->client = client; 318 317 led->dev = dev; 318 + led->num_banks = count; 319 319 led->regmap = devm_regmap_init_i2c(client, &lm3697_regmap_config); 320 320 if (IS_ERR(led->regmap)) { 321 321 ret = PTR_ERR(led->regmap);