From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 25033C2D0A3 for ; Tue, 3 Nov 2020 11:57:37 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id BE66422403 for ; Tue, 3 Nov 2020 11:57:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1604404656; bh=zhhzngwPxwe8HR08UijJ4eFnRiWZBuU9frPjsL2CRgg=; h=Subject:To:Cc:From:Date:List-ID:From; b=pK2LO/4EPx395mSo9ZSj4M7PoNynZah8wMPL1Rohd40Tm5PKDd6aUgz7DCV39vyBG nL5s1cpHEjzYrHdPc4EbKKe6l+uqhfMVmdd4y1W7f9SfkDIuDr2TbZ/j9R8vwkRNpx ngk5fAL20vL3hk3kqD+x38Abmq5o0OTqpZgnpm7Y= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728482AbgKCL5g (ORCPT ); Tue, 3 Nov 2020 06:57:36 -0500 Received: from wforward4-smtp.messagingengine.com ([64.147.123.34]:59337 "EHLO wforward4-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728202AbgKCL5g (ORCPT ); Tue, 3 Nov 2020 06:57:36 -0500 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailforward.west.internal (Postfix) with ESMTP id 438F1B58; Tue, 3 Nov 2020 06:57:35 -0500 (EST) Received: from mailfrontend2 ([10.202.2.163]) by compute4.internal (MEProxy); Tue, 03 Nov 2020 06:57:35 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:message-id:mime-version:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm1; bh=xvwvOn n1lSdEruafzESpqfi20Xy7X90tq4Vkl2iN0e4=; b=aPy2aFNRHjFkPcGSUsNaC1 c0ln9HFeAT0hpbsSQDM8rzPTRL8CfjYucL63oAmgS9bi2fM5EXPBwpnDk12uWY2Q 2Dkez7RYz2FKq2ibRs5kOnKVH/8VaXMOL9py49iznTdeYVZTHtE9IZFwdl060FYr cfDNiP8Ks+Rmz/faGlSk4AGnbFP2Ibb7IqFJ181PP2oaKqoBFiBJGMvhx1AIZEJ+ trR4Npr8zlFuJFeayWkIjy6NbyiNk5no8yRXzb60fVV8lRdtGEoBoOuOgDLJSXsV wWhF5jecNpYyhyb9MlY01nCk4uDBJ2EzhVJeKoG8hgc5dzScgaY4Q/8U+N3PxrQw == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedujedruddtfedgfeegucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpefuvffhfffkgggtgfesthekredttd dtlfenucfhrhhomhepoehgrhgvghhkhheslhhinhhugihfohhunhgurghtihhonhdrohhr gheqnecuggftrfgrthhtvghrnhepieetveehuedvhfdtgfdvieeiheehfeelveevheejud etveeuveeludejjefgteehnecukfhppeekfedrkeeirdejgedrieegnecuvehluhhsthgv rhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomhepghhrvghgsehkrhhorghhrd gtohhm X-ME-Proxy: Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) by mail.messagingengine.com (Postfix) with ESMTPA id 167A03064674; Tue, 3 Nov 2020 06:57:33 -0500 (EST) Subject: FAILED: patch "[PATCH] leds: lm3697: Fix out-of-bound access" failed to apply to 5.9-stable tree To: ultracoolguy@tutanota.com, pavel@ucw.cz Cc: From: Date: Tue, 03 Nov 2020 12:58:26 +0100 Message-ID: <160440470667193@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org The patch below does not apply to the 5.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 98d278ca00bd8f62c8bc98bd9e65372d16eb6956 Mon Sep 17 00:00:00 2001 From: Gabriel David Date: Fri, 2 Oct 2020 18:27:00 -0400 Subject: [PATCH] leds: lm3697: Fix out-of-bound access If both LED banks aren't used in device tree, an out-of-bounds condition in lm3697_init occurs because of the for loop assuming that all the banks are used. Fix it by adding a variable that contains the number of used banks. Signed-off-by: Gabriel David [removed extra rename, minor tweaks] Signed-off-by: Pavel Machek Cc: stable@kernel.org diff --git a/drivers/leds/leds-lm3697.c b/drivers/leds/leds-lm3697.c index 64c0794801e6..7d216cdb91a8 100644 --- a/drivers/leds/leds-lm3697.c +++ b/drivers/leds/leds-lm3697.c @@ -78,6 +78,7 @@ struct lm3697 { struct mutex lock; int bank_cfg; + int num_banks; struct lm3697_led leds[]; }; @@ -180,7 +181,7 @@ static int lm3697_init(struct lm3697 *priv) if (ret) dev_err(dev, "Cannot write OUTPUT config\n"); - for (i = 0; i < LM3697_MAX_CONTROL_BANKS; i++) { + for (i = 0; i < priv->num_banks; i++) { led = &priv->leds[i]; ret = ti_lmu_common_set_ramp(&led->lmu_data); if (ret) @@ -301,8 +302,8 @@ static int lm3697_probe(struct i2c_client *client, int ret; count = device_get_child_node_count(dev); - if (!count) { - dev_err(dev, "LEDs are not defined in device tree!"); + if (!count || count > LM3697_MAX_CONTROL_BANKS) { + dev_err(dev, "Strange device tree!"); return -ENODEV; } @@ -315,6 +316,7 @@ static int lm3697_probe(struct i2c_client *client, led->client = client; led->dev = dev; + led->num_banks = count; led->regmap = devm_regmap_init_i2c(client, &lm3697_regmap_config); if (IS_ERR(led->regmap)) { ret = PTR_ERR(led->regmap);