[PATCH] leds: lm3642: Fix container_of() member confusion in pin attributes

[PATCH] leds: lm3642: Fix container_of() member confusion in pin attributes

[Ziheng Wei]

The strobe_pin and torch_pin sysfs attributes are registered on the
flash and torch LED class devices respectively, but their store
callbacks recover the chip data by container_of() on cdev_indicator.

dev_get_drvdata() in the attribute callbacks returns the led_classdev
that owns the attribute group:

  - strobe_pin is in lm3642_flash_groups, so drvdata is &chip->cdev_flash
  - torch_pin is in lm3642_torch_groups, so drvdata is &chip->cdev_torch

Both strobe_pin_store() and torch_pin_store() however use
container_of(led_cdev, struct lm3642_chip_data, cdev_indicator).

cdev_indicator comes after cdev_flash and cdev_torch in struct
lm3642_chip_data, so the resulting pointer lands before the start of
the structure (by 1536 bytes for strobe_pin and 768 bytes for
torch_pin on x86_64). The callbacks then write chip->strobe_pin or
chip->torch_pin into unrelated memory and pass whatever is found at
the chip->regmap offset to regmap_update_bits().

Writing strobe_pin on an lm3642 instantiated on an emulated I2C
adapter (QEMU, KASAN, v7.3.1) faults the kernel:

  Oops: general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI
  KASAN: null-ptr-deref in range [0x00000000000000a0-0x00000000000000a7]
  RIP: 0010:regmap_update_bits_base+0x4e/0x1c0
  Call Trace:
   strobe_pin_store+0x15d/0x240 [leds_lm3642]
   dev_attr_store+0x5d/0xc0
   sysfs_kf_write+0xfb/0x180

The other three container_of() users in the driver already pick the
member matching the LED class device they are called for.

Use cdev_flash in strobe_pin_store() and cdev_torch in
torch_pin_store().

Found by LLM-assisted static analysis. Not tested on real hardware;
no in-tree board provides lm3642 platform data.

Fixes: 8b7cfbec052d ("leds: Add new LED driver for lm3642 chips")
Cc: stable@vger.kernel.org
Signed-off-by: Ziheng Wei <zihengw03@163.com>
---

Notes:
    The changelog was drafted with an AI assistant from my analysis;
    I have reviewed the code, the fix and the text.

 drivers/leds/leds-lm3642.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/leds/leds-lm3642.c b/drivers/leds/leds-lm3642.c
index 9af8b8e47..91ea41a7c 100644
--- a/drivers/leds/leds-lm3642.c
+++ b/drivers/leds/leds-lm3642.c
@@ -173,7 +173,7 @@ static ssize_t torch_pin_store(struct device *dev,
 	ssize_t ret;
 	struct led_classdev *led_cdev = dev_get_drvdata(dev);
 	struct lm3642_chip_data *chip =
-	    container_of(led_cdev, struct lm3642_chip_data, cdev_indicator);
+	    container_of(led_cdev, struct lm3642_chip_data, cdev_torch);
 	unsigned int state;
 
 	ret = kstrtouint(buf, 10, &state);
@@ -219,7 +219,7 @@ static ssize_t strobe_pin_store(struct device *dev,
 	ssize_t ret;
 	struct led_classdev *led_cdev = dev_get_drvdata(dev);
 	struct lm3642_chip_data *chip =
-	    container_of(led_cdev, struct lm3642_chip_data, cdev_indicator);
+	    container_of(led_cdev, struct lm3642_chip_data, cdev_flash);
 	unsigned int state;
 
 	ret = kstrtouint(buf, 10, &state);

base-commit: 97d73c8251226cf27cc6656b4c542869bb8c69fa
-- 
2.43.0

Re: [PATCH] leds: lm3642: Fix container_of() member confusion in pin attributes

[sashiko-bot]

> The strobe_pin and torch_pin sysfs attributes are registered on the
> flash and torch LED class devices respectively, but their store
> callbacks recover the chip data by container_of() on cdev_indicator.
> 
> dev_get_drvdata() in the attribute callbacks returns the led_classdev
> that owns the attribute group:
> 
>   - strobe_pin is in lm3642_flash_groups, so drvdata is &chip->cdev_flash
>   - torch_pin is in lm3642_torch_groups, so drvdata is &chip->cdev_torch
> 
> Both strobe_pin_store() and torch_pin_store() however use
> container_of(led_cdev, struct lm3642_chip_data, cdev_indicator).
> 
> cdev_indicator comes after cdev_flash and cdev_torch in struct
> lm3642_chip_data, so the resulting pointer lands before the start of
> [ ... ]
> no in-tree board provides lm3642 platform data.
> 
> Fixes: 8b7cfbec052d ("leds: Add new LED driver for lm3642 chips")
> Cc: stable@vger.kernel.org
> Signed-off-by: Ziheng Wei <zihengw03@163.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261115080213.910112-1-zihengw03@163.com?part=1