[PATCH 15/21] leds: lm3532: Validate LED string indices in lm3532_parse_node()

[Lee Jones <lee@kernel.org>]

lm3532_parse_node() reads the led-sources property into led->led_strings
without bounding the individual string indices.  If a firmware node
specifies an index of LM3532_MAX_LED_STRINGS or greater,
lm3532_init_registers() shifts beyond the hardware output configuration
fields and, for values of 16 or greater, triggers a 32-bit
shift-out-of-bounds.

Reject LED string indices >= LM3532_MAX_LED_STRINGS with -EINVAL when
parsing the firmware node.

Fixes: bc1b8492c764 ("leds: lm3532: Introduce the lm3532 LED driver")
Closes: https://sashiko.dev/#/bug/linux-f6f7a3f6-4dc4-46b4-84e3-c26fc9099572
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/leds/leds-lm3532.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/leds/leds-lm3532.c b/drivers/leds/leds-lm3532.c
index cfad4e791e4b..6fe752889487 100644
--- a/drivers/leds/leds-lm3532.c
+++ b/drivers/leds/leds-lm3532.c
@@ -649,6 +649,11 @@ static int lm3532_parse_node(struct lm3532_data *priv)
 			return ret;
 		}
 
+		for (int j = 0; j < led->num_leds; j++) {
+			if (led->led_strings[j] >= LM3532_MAX_LED_STRINGS)
+				return -EINVAL;
+		}
+
 		led->priv = priv;
 		led->led_dev.brightness_set_blocking = lm3532_brightness_set;
 
-- 
2.56.0.218.g1ec904b173-goog