[PATCH 13/21] leds: aat1290: Prevent out-of-bounds read in aat1290_brightness_to_intensity()

[Lee Jones]

When a flash strobe event or external strobe update resets
led_cdev->brightness to LED_OFF (0), a subsequent V4L2 torch intensity
query passes brightness == 0 to aat1290_brightness_to_intensity().
Subtracting 1 unconditionally indexes led->mm_current_scale[-1] out of
bounds.

Return 0 when brightness is LED_OFF before indexing mm_current_scale.

Fixes: ac69b9038f82 ("leds: aat1290: add support for V4L2 Flash sub-device")
Closes: https://sashiko.dev/#/bug/linux-9e7db3d9-0ea0-42f2-8027-01aa467d3a7d
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Lee Jones <lee@xxxxxxxxxx>
---
 drivers/leds/flash/leds-aat1290.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/leds/flash/leds-aat1290.c b/drivers/leds/flash/leds-aat1290.c
index ea9af6c3fbf4..223bbba9114f 100644
--- a/drivers/leds/flash/leds-aat1290.c
+++ b/drivers/leds/flash/leds-aat1290.c
@@ -393,6 +393,9 @@ static s32 aat1290_brightness_to_intensity(struct v4l2_flash *v4l2_flash,
 	struct led_classdev_flash *fled_cdev = v4l2_flash->fled_cdev;
 	struct aat1290_led *led = fled_cdev_to_led(fled_cdev);
 
+	if (brightness == LED_OFF)
+		return 0;
+
 	return led->mm_current_scale[brightness - 1];
 }
 
-- 
2.56.0.218.g1ec904b173-goog