LEDS: tca6507 - fix bugs in parsing of device-tree configuration.
1/ The led_info array must be allocated to allow the full number
of LEDs even if not all are present. The array maybe be sparsely
filled but it is indexed by device address so we must at least
allocate as many slots as the highest address used. It is easiest
just to allocate all 7.
2/ range check the 'reg' value properly.
3/ led.flags must be initialised to zero, else all leds could
be treated as GPIOs (depending on what happens to be on the stack).
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Bryan Wu <cooloney@gmail.com>
diff --git a/drivers/leds/leds-tca6507.c b/drivers/leds/leds-tca6507.c
index 8cc304f..f5063f4 100644
--- a/drivers/leds/leds-tca6507.c
+++ b/drivers/leds/leds-tca6507.c
@@ -682,7 +682,7 @@
return ERR_PTR(-ENODEV);
tca_leds = devm_kzalloc(&client->dev,
- sizeof(struct led_info) * count, GFP_KERNEL);
+ sizeof(struct led_info) * NUM_LEDS, GFP_KERNEL);
if (!tca_leds)
return ERR_PTR(-ENOMEM);
@@ -695,9 +695,9 @@
of_get_property(child, "label", NULL) ? : child->name;
led.default_trigger =
of_get_property(child, "linux,default-trigger", NULL);
-
+ led.flags = 0;
ret = of_property_read_u32(child, "reg", ®);
- if (ret != 0)
+ if (ret != 0 || reg < 0 || reg >= NUM_LEDS)
continue;
tca_leds[reg] = led;
@@ -708,7 +708,7 @@
return ERR_PTR(-ENOMEM);
pdata->leds.leds = tca_leds;
- pdata->leds.num_leds = count;
+ pdata->leds.num_leds = NUM_LEDS;
return pdata;
}