Re: [PATCH v2 2/4] leds: flash: Add support for the TI LM3643 dual LED flash driver

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] leds: TOCTOU race in max_brightness clamping after registration
--

commit 0af4a3a129a9adf0eccf2c17265d6d72e8d4acac
Author: Rillian Grant <rillian.grant@gmail.com>

leds: flash: Add support for the TI LM3643 dual LED flash driver

This commit adds support for the TI LM3643 dual LED flash driver. The chip
features two high-side current sources sharing a synchronous boost converter,
supporting programmable torch and flash modes with fault reporting.

> diff --git a/drivers/leds/flash/leds-lm3643.c b/drivers/leds/flash/leds-lm3643.c
> new file mode 100644
> index 0000000000000..bbe9358c9caaf
> --- /dev/null
> +++ b/drivers/leds/flash/leds-lm3643.c

[ ... ]

> +static int lm3643_register_led(struct device *dev, struct lm3643 *chip,
> +			       struct fwnode_handle *fwnode)
> +{

[ ... ]

> +	ret = devm_led_classdev_flash_register_ext(dev, flash_cdev, &init_data);
> +	if (ret)
> +		return ret;
> +
> +	if (led_cdev->max_brightness > torch_max_brightness) {
> +		dev_warn(dev, "max-brightness %u not supported (using %u)\n",
> +			 led_cdev->max_brightness,
> +			 torch_max_brightness);
> +		led_cdev->max_brightness = torch_max_brightness;
> +	}

[Severity: Medium]
Is there a TOCTOU race condition here? By clamping
led_cdev->max_brightness after calling
devm_led_classdev_flash_register_ext(), isn't there a window where the
device is exposed to userspace with the unclamped value?

Once registered, sysfs attributes are active and a KOBJ_ADD uevent is sent.
Could a fast userspace process read the unclamped max_brightness and
write an over-limit brightness value before the driver clamps it,
potentially driving the LED beyond its configured led-max-microamp
thermal limit?

This could happen if a device tree provides a max-brightness property
higher than the led-max-microamp limit. The LED core's
led_classdev_register_ext() overwrites led_cdev->max_brightness with
this value and creates the sysfs interfaces before this subsequent clamping
step runs.

> +
> +	return lm3643_register_v4l2(dev, led, fwnode);
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260928094302.86966-1-rillian.grant@gmail.com?part=2