From: Lee Jones <lee@kernel.org>
To: lee@kernel.org, Pavel Machek <pavel@kernel.org>,
Dan Murphy <dmurphy@ti.com>,
Jacek Anaszewski <jacek.anaszewski@gmail.com>,
linux-leds@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
Subject: [PATCH 16/21] leds: lm3532: Clamp full-scale current to minimum bound
Date: Wed, 21 Oct 2026 12:32:25 +0000 [thread overview]
Message-ID: <20261021123406.3163547-17-lee@kernel.org> (raw)
In-Reply-To: <20261021123406.3163547-1-lee@kernel.org>
lm3532_parse_node() bounds led->full_scale_current to LM3532_FS_CURR_MAX
using min(), but does not enforce the lower bound LM3532_FS_CURR_MIN.
If a firmware node specifies led-max-microamp between 1 and
LM3532_FS_CURR_MIN - 1, subtracting LM3532_FS_CURR_MIN in
lm3532_init_registers() underflows and writes a corrupted full-scale
current register value.
Use clamp() when led-max-microamp is present so led->full_scale_current
is bounded to [LM3532_FS_CURR_MIN, LM3532_FS_CURR_MAX].
Fixes: 517ea49a7b23 ("leds: lm3532: Add full scale current configuration")
Closes: https://sashiko.dev/#/bug/linux-114b6c69-6d76-4f4d-bb87-0980b1e15bbd
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
drivers/leds/leds-lm3532.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
diff --git a/drivers/leds/leds-lm3532.c b/drivers/leds/leds-lm3532.c
index 6fe752889487..327460de2ff8 100644
--- a/drivers/leds/leds-lm3532.c
+++ b/drivers/leds/leds-lm3532.c
@@ -615,14 +615,16 @@ static int lm3532_parse_node(struct lm3532_data *priv)
return ret;
}
- if (fwnode_property_present(child, "led-max-microamp") &&
- fwnode_property_read_u32(child, "led-max-microamp",
- &led->full_scale_current))
- dev_err(&priv->client->dev,
- "Failed getting led-max-microamp\n");
- else
- led->full_scale_current = min(led->full_scale_current,
- LM3532_FS_CURR_MAX);
+ if (fwnode_property_present(child, "led-max-microamp")) {
+ if (fwnode_property_read_u32(child, "led-max-microamp",
+ &led->full_scale_current))
+ dev_err(&priv->client->dev,
+ "Failed getting led-max-microamp\n");
+ else
+ led->full_scale_current = clamp(led->full_scale_current,
+ LM3532_FS_CURR_MIN,
+ LM3532_FS_CURR_MAX);
+ }
if (led->mode == LM3532_BL_MODE_ALS) {
led->mode = LM3532_ALS_CTRL;
--
2.56.0.218.g1ec904b173-goog
next prev parent reply other threads:[~2026-10-21 12:35 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-21 12:32 [PATCH 00/21] leds: Assorted bug fixes across core, flash, trigger, and drivers Lee Jones
2026-10-21 12:32 ` [PATCH 01/21] leds: lm3532: Propagate error from devm_regulator_get() Lee Jones
2026-10-21 12:32 ` [PATCH 02/21] leds: lm3532: Use dev_err_probe() when lm3532_parse_node() fails Lee Jones
2026-10-21 12:32 ` [PATCH 03/21] leds: trigger: netdev: Hold RTNL lock across hw_control_get_device() in activate Lee Jones
2026-10-21 12:32 ` [PATCH 04/21] leds: aw2013: Guard LED array index in aw2013_probe_dt() Lee Jones
2026-10-27 14:27 ` Nikita Travkin
2026-10-21 12:32 ` [PATCH 05/21] leds: pca955x: Take a reference on the child firmware node Lee Jones
2026-10-21 12:32 ` [PATCH 06/21] leds: lp50xx: Guard sub-LED count in lp50xx_probe_dt() Lee Jones
2026-10-21 12:32 ` [PATCH 07/21] leds: trigger: netdev: Serialise work cancellation and state updates Lee Jones
2026-10-21 12:32 ` [PATCH 08/21] leds: sgm3140: Replace powerdown timer with delayed work Lee Jones
2026-10-21 12:32 ` [PATCH 09/21] leds: sgm3140: Cancel powerdown work via devres after LED unregistration Lee Jones
2026-10-21 12:32 ` [PATCH 10/21] leds: class: Initialise trigger_lock before exposing sysfs attributes Lee Jones
2026-10-21 12:32 ` [PATCH 11/21] leds: class: Unlock led_access before unregistering device on error Lee Jones
2026-10-21 12:32 ` [PATCH 12/21] leds: aat1290: Retain child device_node reference for device lifetime Lee Jones
2026-10-21 12:32 ` [PATCH 13/21] leds: aat1290: Prevent out-of-bounds read in aat1290_brightness_to_intensity() Lee Jones
2026-10-21 12:32 ` [PATCH 14/21] leds: flash: Avoid divide-by-zero in led_clamp_align() Lee Jones
2026-10-22 19:20 ` Jacek Anaszewski
2026-10-22 21:00 ` David Laight
2026-10-26 17:31 ` Lee Jones
2026-10-26 18:37 ` David Laight
2026-10-21 12:32 ` [PATCH 15/21] leds: lm3532: Validate LED string indices in lm3532_parse_node() Lee Jones
2026-10-21 12:32 ` Lee Jones [this message]
2026-10-21 12:32 ` [PATCH 17/21] leds: aat1290: Avoid leaking devres pinctrl handles on strobe source changes Lee Jones
2026-10-21 12:32 ` [PATCH 18/21] leds: aw2013: Unlock chip mutex before registering LEDs Lee Jones
2026-10-27 14:28 ` Nikita Travkin
2026-10-21 12:32 ` [PATCH 19/21] leds: is31fl32xx: Clamp channel current limit in is31fl3293_reset() Lee Jones
2026-10-21 12:32 ` [PATCH 20/21] leds: flash: Terminate sysfs_groups array with NULL Lee Jones
2026-10-21 12:32 ` [PATCH 21/21] leds: lm3692x: Use devm_mutex_init() to avoid premature mutex destruction Lee Jones
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261021123406.3163547-17-lee@kernel.org \
--to=lee@kernel.org \
--cc=dmurphy@ti.com \
--cc=jacek.anaszewski@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-leds@vger.kernel.org \
--cc=pavel@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.