Commit 17c13c72 authored by Maarten Zanders's avatar Maarten Zanders Committed by Pavel Machek
Browse files

leds: lp5523: fix out-of-bounds bug in lp5523_selftest() 



When not all LED channels of the led chip are configured, the
sysfs selftest functionality gives erroneous results and tries to
test all channels of the chip.
There is a potential for LED overcurrent conditions since the
test current will be set to values from out-of-bound regions.

It is wrong to use pdata->led_config[i].led_current to skip absent
channels as led_config[] only contains the configured LED channels.

Instead of iterating over all the physical channels of the device,
loop over the available LED configurations and use led->chan_nr to
access the correct i2c registers. Keep the zero-check for the LED
current as existing users might depend on this to disable a channel.

Reported-by: default avatarArne Staessen <a.staessen@televic.com>
Signed-off-by: default avatarMaarten Zanders <maarten.zanders@mind.be>
Signed-off-by: default avatarPavel Machek <pavel@ucw.cz>
parent 5f52a8ba

drivers/leds/leds-lp5523.c

+15 −12
Original line number Diff line number Diff line
@@ -581,8 +581,8 @@ static ssize_t lp5523_selftest(struct device *dev, 
	struct lp55xx_led *led = i2c_get_clientdata(to_i2c_client(dev));

	struct lp55xx_chip *chip = led->chip;

	struct lp55xx_platform_data *pdata = chip->pdata;

	int i, ret, pos = 0;

	u8 status, adc, vdd;

	int ret, pos = 0;

	u8 status, adc, vdd, i;



	mutex_lock(&chip->lock);
@@ -612,20 +612,21 @@ static ssize_t lp5523_selftest(struct device *dev, 


	vdd--;	/* There may be some fluctuation in measurement */



	for (i = 0; i < LP5523_MAX_LEDS; i++) {

		/* Skip non-existing channels */

	for (i = 0; i < pdata->num_channels; i++) {

		/* Skip disabled channels */

		if (pdata->led_config[i].led_current == 0)

			continue;



		/* Set default current */

		lp55xx_write(chip, LP5523_REG_LED_CURRENT_BASE + i,

		lp55xx_write(chip, LP5523_REG_LED_CURRENT_BASE + led->chan_nr,

			pdata->led_config[i].led_current);



		lp55xx_write(chip, LP5523_REG_LED_PWM_BASE + i, 0xff);

		lp55xx_write(chip, LP5523_REG_LED_PWM_BASE + led->chan_nr,

			     0xff);

		/* let current stabilize 2 - 4ms before measurements start */

		usleep_range(2000, 4000);

		lp55xx_write(chip, LP5523_REG_LED_TEST_CTRL,

			     LP5523_EN_LEDTEST | i);

			     LP5523_EN_LEDTEST | led->chan_nr);

		/* ADC conversion time is 2.7 ms typically */

		usleep_range(3000, 6000);

		ret = lp55xx_read(chip, LP5523_REG_STATUS, &status);
@@ -640,12 +641,14 @@ static ssize_t lp5523_selftest(struct device *dev, 
			goto fail;



		if (adc >= vdd || adc < LP5523_ADC_SHORTCIRC_LIM)

			pos += sprintf(buf + pos, "LED %d FAIL\n", i);

			pos += sprintf(buf + pos, "LED %d FAIL\n",

				       led->chan_nr);



		lp55xx_write(chip, LP5523_REG_LED_PWM_BASE + i, 0x00);

		lp55xx_write(chip, LP5523_REG_LED_PWM_BASE + led->chan_nr,

			     0x00);



		/* Restore current */

		lp55xx_write(chip, LP5523_REG_LED_CURRENT_BASE + i,

		lp55xx_write(chip, LP5523_REG_LED_CURRENT_BASE + led->chan_nr,

			     led->led_current);

		led++;

	}