Re: [PATCH v3] leds: flash: leds-qcom-flash: Release all V4L2 flash devices

[sashiko-bot@kernel.org]

> From: George Neacsu <geocausa@gmail.com>
> 
> The probe error path and qcom_flash_led_remove() use leds_count as an
> array index before decrementing it. Since leds_count is the number of
> registered LEDs, that first access is one entry past the last registered
> V4L2 flash device. The loops also stop before index 0, so with a single
> LED nothing is released at all.
> 
> The V4L2 flash sub-device then stays registered after the driver is
> unbound, still pointing at the driver's freed devm memory. On a Surface
> Pro 11 (X1E80100, PM8550 flash, IR LED linked to a sensor through
> flash-leds), unloading the module and then setting a flash control on
> the sub-device triggered UBSAN shift-out-of-bounds reports and a NULL
> pointer dereference in regmap_field_update_bits_base(), called from
> update_allowed_flash_current().
> 
> Release the registered entries from leds_count - 1 down to 0. Initialize
> the mutex with devm_mutex_init() before registering managed LED class
> devices so it remains valid until their devres cleanup has completed.
> Route a final torch-clamp programming failure through the V4L2 cleanup
> as well.
> 
> Fixes: 96a2e242a5dc ("leds: flash: Add driver to support flash LED module in QCOM PMICs")
> Cc: stable@vger.kernel.org
> Reported-by: Sashiko AI review <sashiko-bot@kernel.org>
> Link: https://sashiko.dev/#/patchset/20261016-qcom-flash-v4l2-release-v1-1-0e92aa7c9327@gmail.com?part=1
> Link: https://sashiko.dev/#/patchset/20261018-qcom-flash-v4l2-release-v2-1-8e2297844d9f@gmail.com?part=1
> Assisted-by: Claude:claude-opus-5-5
> Assisted-by: ChatGPT:gpt-5.6-sol
> Signed-off-by: George Neacsu <geocausa@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261018-qcom-flash-v4l2-release-v3-1-02e18d30b18a@gmail.com?part=1