On Tue, Mar 05, 2024 at 09:23:07AM +0100, Geert Uytterhoeven wrote: > On Tue, Mar 5, 2024 at 4:59 AM Chris Packham > <chris.packham@xxxxxxxxxxxxxxxxxxx> wrote: ... > > + priv->segment_gpios = devm_gpiod_get_array(dev, "segment", GPIOD_OUT_LOW); > > + if (IS_ERR(priv->segment_gpios)) > > + return PTR_ERR(priv->segment_gpios); > > This needs some validation of priv->segment_gpios->ndescs, else the > call to gpiod_set_array_value_cansleep() in seg_led_update() may > trigger an out-of-bounds access of the values bitmap. Alternatively we can call gpiod_count() beforehand and check its result. -- With Best Regards, Andy Shevchenko