From: surendra <kr494167@gmail.com>

lp5860_iterate_subleds() detects a channel ID greater than the
hardware limit, but returns the successful result of
fwnode_property_read_u32(). The caller therefore treats the malformed
sub-LED description as valid and uses the invalid ID for register
addressing.

Return -EINVAL when the channel ID is out of range.

Fixes: f0a66563aa2d ("leds: Add support for TI LP5860 LED driver chip")
Signed-off-by: surendra <kr494167@gmail.com>
---
 drivers/leds/rgb/leds-lp5860-core.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/leds/rgb/leds-lp5860-core.c b/drivers/leds/rgb/leds-lp5860-core.c
index e21d5f2302be..75498311b080 100644
--- a/drivers/leds/rgb/leds-lp5860-core.c
+++ b/drivers/leds/rgb/leds-lp5860-core.c
@@ -114,12 +114,18 @@ static int lp5860_iterate_subleds(struct lp5860_led *led, struct led_init_data *
 		}
 
 		ret = fwnode_property_read_u32(led_node, "reg", &channel);
-		if (ret < 0 || channel > LP5860_MAX_LED) {
+		if (ret < 0) {
 			dev_err_probe(led->chip->dev, ret,
 				      "%pfwP: 'reg' property is missing. Skipping.\n", led_node);
 			fwnode_handle_put(led_node);
 			return ret;
 		}
+		if (channel > LP5860_MAX_LED) {
+			dev_err(led->chip->dev, "%pfwP: 'reg' property is out of range.\n",
+				led_node);
+			fwnode_handle_put(led_node);
+			return -EINVAL;
+		}
 
 		led->mc_cdev.subled_info[subled].color_index = color_index;
 		led->mc_cdev.subled_info[subled].channel = channel;
-- 
2.55.0