From nobody Fri Apr 3 11:12:45 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2C0B51F30A4; Thu, 19 Feb 2026 14:34:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771511680; cv=none; b=oJgU19EuBi7BgsEt+MgOdIdPs/+gQM+HEqfatnMRvMmCHWUUMAom+K/Iakax4ffUUvn/IV7lF2ahLcGEn24yznENa18oBjOHLq5pjBsSuGwNdunBXyW0MFY62ZqQ4pgfQtY4Cm/tkNy4pTv9UGX0vo4m1VyUs5znaQ8hFWGsF4Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771511680; c=relaxed/simple; bh=RG5Hfgymi3riW3PE9yJni3eUxCYk3oiRt1b+niVy5Yc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=bxZ8iPuBL8R745GwsvqvM2/sa8/Mk11gx2ZioH0FD0oRgV7dvd/rTgO5taaWZpCWJLZp1jTwoxiagtyE8MjaLzznc+yYYsPpXGrDjD6Et1KIilS8ieGMo1C6Go8JrzNtfRvKLLgXlbbszITX4gALWjXclAS4zGaD0DjrG5n2ZuI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Qwtd0xGt; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Qwtd0xGt" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5A8B5C116C6; Thu, 19 Feb 2026 14:34:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1771511679; bh=RG5Hfgymi3riW3PE9yJni3eUxCYk3oiRt1b+niVy5Yc=; h=From:To:Cc:Subject:Date:From; b=Qwtd0xGtGRoDIHLCOW3oHZ7TDMAbiHIiShD5BOmZFF3c4WBv2k9tfRvXhohlONMpx glRjeuq/+wUp1F9WSX+qPoasNlhlli9c0zCoNcqU5BIShdvHKO9L9ofBOsvGf5T3G/ o+eFFN5lzyF1rqYqzQSb0F3l/SX3V5VpAtdzudQE= From: Greg Kroah-Hartman To: linux-leds@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Greg Kroah-Hartman , Lee Jones , Pavel Machek , stable Subject: [PATCH] leds: qcom-lpg: Check for array overflow when selecting the high resolution Date: Thu, 19 Feb 2026 15:34:35 +0100 Message-ID: <2026021934-nearby-playroom-036b@gregkh> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1654; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=RG5Hfgymi3riW3PE9yJni3eUxCYk3oiRt1b+niVy5Yc=; b=owGbwMvMwCRo6H6F97bub03G02pJDJnT5atctL9p3XlrsUft3PI3Xmz9jZqbYvr/HZt46/PMf fYVIq43OmJZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAivrMZ5vAkvXisZac5cXJC 7NzMWDXTO868JgzzXcSztty5vv/oq3f5cnHWIi+4r5ukAwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When selecting the high resolution values from the array, FIELD_GET() is used to pull from a 3 bit register, yet the array being indexed has only 5 values in it. Odds are the hardware is sane, but just to be safe, properly check before just overflowing and reading random data and then setting up chip values based on that. Cc: Lee Jones Cc: Pavel Machek Cc: linux-leds@vger.kernel.org Assisted-by: gkh_clanker_2000 Cc: stable Signed-off-by: Greg Kroah-Hartman --- This issue was found by running a tool to compare a past kernel CVE to try to find any potential places in the existing codebase that was missed with the original fix. drivers/leds/rgb/leds-qcom-lpg.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/leds/rgb/leds-qcom-lpg.c b/drivers/leds/rgb/leds-qcom-= lpg.c index f54851dfb42f..1da384b07dc0 100644 --- a/drivers/leds/rgb/leds-qcom-lpg.c +++ b/drivers/leds/rgb/leds-qcom-lpg.c @@ -1273,7 +1273,12 @@ static int lpg_pwm_get_state(struct pwm_chip *chip, = struct pwm_device *pwm, return ret; =20 if (chan->subtype =3D=3D LPG_SUBTYPE_HI_RES_PWM) { - refclk =3D lpg_clk_rates_hi_res[FIELD_GET(PWM_CLK_SELECT_HI_RES_MASK, va= l)]; + unsigned int clk_idx =3D FIELD_GET(PWM_CLK_SELECT_HI_RES_MASK, val); + + if (clk_idx >=3D ARRAY_SIZE(lpg_clk_rates_hi_res)) + return -EINVAL; + + refclk =3D lpg_clk_rates_hi_res[clk_idx]; resolution =3D lpg_pwm_resolution_hi_res[FIELD_GET(PWM_SIZE_HI_RES_MASK,= val)]; } else { refclk =3D lpg_clk_rates[FIELD_GET(PWM_CLK_SELECT_MASK, val)]; --=20 2.53.0