[PATCH 04/21] leds: aw2013: Guard LED array index in aw2013_probe_dt()

[Lee Jones <lee@kernel.org>]

aw2013_probe_dt() validates the initial child node count against
AW2013_MAX_LEDS via of_get_available_child_count() before iterating over
available child nodes with for_each_available_child_of_node_scoped().

Add an explicit bounds check on the loop index before indexing into
chip->leds[] to ensure the statically sized array cannot be overrun if
additional child nodes become available during iteration.

Fixes: 59ea3c9faf32 ("leds: add aw2013 driver")
Closes: https://sashiko.dev/#/bug/linux-577a1fa0-4e80-42cc-8c7f-34c43c131d95
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/leds/leds-aw2013.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/leds/leds-aw2013.c b/drivers/leds/leds-aw2013.c
index 216755d6010f..dfeac8b2993f 100644
--- a/drivers/leds/leds-aw2013.c
+++ b/drivers/leds/leds-aw2013.c
@@ -286,6 +286,9 @@ static int aw2013_probe_dt(struct aw2013 *chip)
 			continue;
 		}
 
+		if (i >= AW2013_MAX_LEDS)
+			return -EINVAL;
+
 		led = &chip->leds[i];
 		led->num = source;
 		led->chip = chip;
-- 
2.56.0.218.g1ec904b173-goog