Re: (subset) [PATCH v3] leds: flash: leds-qcom-flash: Release all V4L2 flash devices

[Lee Jones]

On Sun, 18 Oct 2026 22:38:27 +0100, George Neacsu wrote:
> The probe error path and qcom_flash_led_remove() use leds_count as an
> array index before decrementing it. Since leds_count is the number of
> registered LEDs, that first access is one entry past the last registered
> V4L2 flash device. The loops also stop before index 0, so with a single
> LED nothing is released at all.
> 
> The V4L2 flash sub-device then stays registered after the driver is
> unbound, still pointing at the driver's freed devm memory. On a Surface
> Pro 11 (X1E80100, PM8550 flash, IR LED linked to a sensor through
> flash-leds), unloading the module and then setting a flash control on
> the sub-device triggered UBSAN shift-out-of-bounds reports and a NULL
> pointer dereference in regmap_field_update_bits_base(), called from
> update_allowed_flash_current().
> 
> [...]

Applied, thanks!

[1/1] leds: flash: leds-qcom-flash: Release all V4L2 flash devices
      commit: 4b2f49cc6998dc7fa243eed13cab8c48a4d95138

--
Lee Jones [李琼斯]