[PATCH 06/21] leds: lp50xx: Guard sub-LED count in lp50xx_probe_dt()
From: Lee Jones
Date: Wed Oct 21 2026 - 08:43:05 EST
lp50xx_probe_dt() allocates mc_led_info with LP50XX_LEDS_PER_MODULE (3)
elements and increments num_colors for each sub-LED child node without
checking whether num_colors has already reached LP50XX_LEDS_PER_MODULE.
If a device tree specifies more than three sub-LED child nodes with
valid reg properties, led->mc_cdev.num_colors exceeds the capacity of
the subled_info array, causing out-of-bounds accesses during brightness
and intensity updates.
Return -EINVAL if num_colors reaches LP50XX_LEDS_PER_MODULE when
iterating over sub-LED child nodes.
Fixes: 242b81170fb8 ("leds: lp50xx: Add the LP50XX family of the RGB LED driver")
Closes: https://sashiko.dev/#/bug/linux-a0c116ab-2f34-4f53-a007-d7a42f28677b
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Lee Jones <lee@xxxxxxxxxx>
---
drivers/leds/leds-lp50xx.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/leds/leds-lp50xx.c b/drivers/leds/leds-lp50xx.c
index 20bfb315bda1..32b0d802d474 100644
--- a/drivers/leds/leds-lp50xx.c
+++ b/drivers/leds/leds-lp50xx.c
@@ -507,6 +507,14 @@ static int lp50xx_probe_dt(struct lp50xx *priv)
fwnode_for_each_child_node(child, led_node) {
int multi_index;
+
+ if (num_colors >= LP50XX_LEDS_PER_MODULE) {
+ fwnode_handle_put(led_node);
+ return dev_err_probe(priv->dev, -EINVAL,
+ "Too many sub-LEDs (max %d)\n",
+ LP50XX_LEDS_PER_MODULE);
+ }
+
ret = fwnode_property_read_u32(led_node, "color",
&color_id);
if (ret) {
--
2.56.0.218.g1ec904b173-goog