[PATCH] leds: qcom-lpg: Check for array overflow when selecting the high resolution

[PATCH] leds: qcom-lpg: Check for array overflow when selecting the high resolution

[Greg Kroah-Hartman]

When selecting the high resolution values from the array, FIELD_GET() is
used to pull from a 3 bit register, yet the array being indexed has only
5 values in it.  Odds are the hardware is sane, but just to be safe,
properly check before just overflowing and reading random data and then
setting up chip values based on that.

Cc: Lee Jones <lee@kernel.org>
Cc: Pavel Machek <pavel@kernel.org>
Cc: linux-leds@vger.kernel.org
Assisted-by: gkh_clanker_2000
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
This issue was found by running a tool to compare a past kernel CVE to
try to find any potential places in the existing codebase that was
missed with the original fix.

 drivers/leds/rgb/leds-qcom-lpg.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/leds/rgb/leds-qcom-lpg.c b/drivers/leds/rgb/leds-qcom-lpg.c
index f54851dfb42f..1da384b07dc0 100644
--- a/drivers/leds/rgb/leds-qcom-lpg.c
+++ b/drivers/leds/rgb/leds-qcom-lpg.c
@@ -1273,7 +1273,12 @@ static int lpg_pwm_get_state(struct pwm_chip *chip, struct pwm_device *pwm,
 		return ret;
 
 	if (chan->subtype == LPG_SUBTYPE_HI_RES_PWM) {
-		refclk = lpg_clk_rates_hi_res[FIELD_GET(PWM_CLK_SELECT_HI_RES_MASK, val)];
+		unsigned int clk_idx = FIELD_GET(PWM_CLK_SELECT_HI_RES_MASK, val);
+
+		if (clk_idx >= ARRAY_SIZE(lpg_clk_rates_hi_res))
+			return -EINVAL;
+
+		refclk = lpg_clk_rates_hi_res[clk_idx];
 		resolution = lpg_pwm_resolution_hi_res[FIELD_GET(PWM_SIZE_HI_RES_MASK, val)];
 	} else {
 		refclk = lpg_clk_rates[FIELD_GET(PWM_CLK_SELECT_MASK, val)];
-- 
2.53.0

Re: (subset) [PATCH] leds: qcom-lpg: Check for array overflow when selecting the high resolution

[Lee Jones]

On Thu, 19 Feb 2026 15:34:35 +0100, Greg Kroah-Hartman wrote:
> When selecting the high resolution values from the array, FIELD_GET() is
> used to pull from a 3 bit register, yet the array being indexed has only
> 5 values in it.  Odds are the hardware is sane, but just to be safe,
> properly check before just overflowing and reading random data and then
> setting up chip values based on that.
> 
> 
> [...]

Applied, thanks!

[1/1] leds: qcom-lpg: Check for array overflow when selecting the high resolution
      commit: 292aeaef0a0c3aa6f32c9e12d77503bd348c0e7a

--
Lee Jones [李琼斯]