* FAILED: patch "[PATCH] leds: lm3697: Fix out-of-bound access" failed to apply to 5.9-stable tree
@ 2020-11-03 11:58 gregkh
2020-11-18 22:59 ` Sudip Mukherjee
0 siblings, 1 reply; 4+ messages in thread
From: gregkh @ 2020-11-03 11:58 UTC (permalink / raw)
To: ultracoolguy, pavel; +Cc: stable
The patch below does not apply to the 5.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 98d278ca00bd8f62c8bc98bd9e65372d16eb6956 Mon Sep 17 00:00:00 2001
From: Gabriel David <ultracoolguy@tutanota.com>
Date: Fri, 2 Oct 2020 18:27:00 -0400
Subject: [PATCH] leds: lm3697: Fix out-of-bound access
If both LED banks aren't used in device tree, an out-of-bounds
condition in lm3697_init occurs because of the for loop assuming that
all the banks are used. Fix it by adding a variable that contains the
number of used banks.
Signed-off-by: Gabriel David <ultracoolguy@tutanota.com>
[removed extra rename, minor tweaks]
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Cc: stable@kernel.org
diff --git a/drivers/leds/leds-lm3697.c b/drivers/leds/leds-lm3697.c
index 64c0794801e6..7d216cdb91a8 100644
--- a/drivers/leds/leds-lm3697.c
+++ b/drivers/leds/leds-lm3697.c
@@ -78,6 +78,7 @@ struct lm3697 {
struct mutex lock;
int bank_cfg;
+ int num_banks;
struct lm3697_led leds[];
};
@@ -180,7 +181,7 @@ static int lm3697_init(struct lm3697 *priv)
if (ret)
dev_err(dev, "Cannot write OUTPUT config\n");
- for (i = 0; i < LM3697_MAX_CONTROL_BANKS; i++) {
+ for (i = 0; i < priv->num_banks; i++) {
led = &priv->leds[i];
ret = ti_lmu_common_set_ramp(&led->lmu_data);
if (ret)
@@ -301,8 +302,8 @@ static int lm3697_probe(struct i2c_client *client,
int ret;
count = device_get_child_node_count(dev);
- if (!count) {
- dev_err(dev, "LEDs are not defined in device tree!");
+ if (!count || count > LM3697_MAX_CONTROL_BANKS) {
+ dev_err(dev, "Strange device tree!");
return -ENODEV;
}
@@ -315,6 +316,7 @@ static int lm3697_probe(struct i2c_client *client,
led->client = client;
led->dev = dev;
+ led->num_banks = count;
led->regmap = devm_regmap_init_i2c(client, &lm3697_regmap_config);
if (IS_ERR(led->regmap)) {
ret = PTR_ERR(led->regmap);
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: FAILED: patch "[PATCH] leds: lm3697: Fix out-of-bound access" failed to apply to 5.9-stable tree
2020-11-03 11:58 FAILED: patch "[PATCH] leds: lm3697: Fix out-of-bound access" failed to apply to 5.9-stable tree gregkh
@ 2020-11-18 22:59 ` Sudip Mukherjee
2020-11-20 8:54 ` Greg KH
0 siblings, 1 reply; 4+ messages in thread
From: Sudip Mukherjee @ 2020-11-18 22:59 UTC (permalink / raw)
To: gregkh; +Cc: ultracoolguy, pavel, stable
[-- Attachment #1: Type: text/plain, Size: 399 bytes --]
Hi Greg,
On Tue, Nov 03, 2020 at 12:58:26PM +0100, gregkh@linuxfoundation.org wrote:
>
> The patch below does not apply to the 5.9-stable tree.
> If someone wants it applied there, or to any other stable or longterm
> tree, then please email the backport, including the original git commit
> id to <stable@vger.kernel.org>.
Here is the backport. Please consider for 5.9-stable.
--
Regards
Sudip
[-- Attachment #2: 0001-leds-lm3697-Fix-out-of-bound-access.patch --]
[-- Type: text/x-diff, Size: 2092 bytes --]
From cbaecee1e0a2aee549ecbe7f2f66a767794faef8 Mon Sep 17 00:00:00 2001
From: Gabriel David <ultracoolguy@tutanota.com>
Date: Fri, 2 Oct 2020 18:27:00 -0400
Subject: [PATCH] leds: lm3697: Fix out-of-bound access
commit 98d278ca00bd8f62c8bc98bd9e65372d16eb6956 upstream
If both LED banks aren't used in device tree, an out-of-bounds
condition in lm3697_init occurs because of the for loop assuming that
all the banks are used. Fix it by adding a variable that contains the
number of used banks.
Signed-off-by: Gabriel David <ultracoolguy@tutanota.com>
[removed extra rename, minor tweaks]
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Cc: stable@kernel.org
[sudip: use client->dev]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
---
drivers/leds/leds-lm3697.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/leds/leds-lm3697.c b/drivers/leds/leds-lm3697.c
index 024983088d59..31f5ed486839 100644
--- a/drivers/leds/leds-lm3697.c
+++ b/drivers/leds/leds-lm3697.c
@@ -78,6 +78,7 @@ struct lm3697 {
struct mutex lock;
int bank_cfg;
+ int num_banks;
struct lm3697_led leds[];
};
@@ -180,7 +181,7 @@ static int lm3697_init(struct lm3697 *priv)
if (ret)
dev_err(&priv->client->dev, "Cannot write OUTPUT config\n");
- for (i = 0; i < LM3697_MAX_CONTROL_BANKS; i++) {
+ for (i = 0; i < priv->num_banks; i++) {
led = &priv->leds[i];
ret = ti_lmu_common_set_ramp(&led->lmu_data);
if (ret)
@@ -307,8 +308,8 @@ static int lm3697_probe(struct i2c_client *client,
int ret;
count = device_get_child_node_count(&client->dev);
- if (!count) {
- dev_err(&client->dev, "LEDs are not defined in device tree!");
+ if (!count || count > LM3697_MAX_CONTROL_BANKS) {
+ dev_err(&client->dev, "Strange device tree!");
return -ENODEV;
}
@@ -322,6 +323,7 @@ static int lm3697_probe(struct i2c_client *client,
led->client = client;
led->dev = &client->dev;
+ led->num_banks = count;
led->regmap = devm_regmap_init_i2c(client, &lm3697_regmap_config);
if (IS_ERR(led->regmap)) {
ret = PTR_ERR(led->regmap);
--
2.11.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: FAILED: patch "[PATCH] leds: lm3697: Fix out-of-bound access" failed to apply to 5.9-stable tree
2020-11-18 22:59 ` Sudip Mukherjee
@ 2020-11-20 8:54 ` Greg KH
2020-11-25 12:48 ` Pavel Machek
0 siblings, 1 reply; 4+ messages in thread
From: Greg KH @ 2020-11-20 8:54 UTC (permalink / raw)
To: Sudip Mukherjee; +Cc: ultracoolguy, pavel, stable
On Wed, Nov 18, 2020 at 10:59:38PM +0000, Sudip Mukherjee wrote:
> Hi Greg,
>
> On Tue, Nov 03, 2020 at 12:58:26PM +0100, gregkh@linuxfoundation.org wrote:
> >
> > The patch below does not apply to the 5.9-stable tree.
> > If someone wants it applied there, or to any other stable or longterm
> > tree, then please email the backport, including the original git commit
> > id to <stable@vger.kernel.org>.
>
> Here is the backport. Please consider for 5.9-stable.
Now applied, thanks.
greg k-h
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: FAILED: patch "[PATCH] leds: lm3697: Fix out-of-bound access" failed to apply to 5.9-stable tree
2020-11-20 8:54 ` Greg KH
@ 2020-11-25 12:48 ` Pavel Machek
0 siblings, 0 replies; 4+ messages in thread
From: Pavel Machek @ 2020-11-25 12:48 UTC (permalink / raw)
To: Greg KH; +Cc: Sudip Mukherjee, ultracoolguy, stable
[-- Attachment #1: Type: text/plain, Size: 754 bytes --]
On Fri 2020-11-20 09:54:41, Greg KH wrote:
> On Wed, Nov 18, 2020 at 10:59:38PM +0000, Sudip Mukherjee wrote:
> > Hi Greg,
> >
> > On Tue, Nov 03, 2020 at 12:58:26PM +0100, gregkh@linuxfoundation.org wrote:
> > >
> > > The patch below does not apply to the 5.9-stable tree.
> > > If someone wants it applied there, or to any other stable or longterm
> > > tree, then please email the backport, including the original git commit
> > > id to <stable@vger.kernel.org>.
> >
> > Here is the backport. Please consider for 5.9-stable.
>
> Now applied, thanks.
Note that this is theoretical problem as device trees triggering it
are not circulating in the wild.
Best regards,
Pavel
--
http://www.livejournal.com/~pavelmachek
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2020-11-25 12:48 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-11-03 11:58 FAILED: patch "[PATCH] leds: lm3697: Fix out-of-bound access" failed to apply to 5.9-stable tree gregkh
2020-11-18 22:59 ` Sudip Mukherjee
2020-11-20 8:54 ` Greg KH
2020-11-25 12:48 ` Pavel Machek
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.