On Thu, Oct 31, 2013 at 7:33 PM, NeilBrown <neilb@xxxxxxx> wrote: > > > 1/ The led_info array must be allocated to allow the full number > of LEDs even if not all are present. The array maybe be sparsely > filled but it is indexed by device address so we must at least > allocate as many slots as the highest address used. It is easiest > just to allocate all 7. > > 2/ range check the 'reg' value properly. > > 3/ led.flags must be initialised to zero, else all leds could > be treated as GPIOs (depending on what happens to be on the stack). > > Signed-off-by: NeilBrown <neilb@xxxxxxx> > Thanks, queued into devel branch of my tree for 3.14 kernel. -Bryan > diff --git a/drivers/leds/leds-tca6507.c b/drivers/leds/leds-tca6507.c > index 8cc304f36728..f5063f447463 100644 > --- a/drivers/leds/leds-tca6507.c > +++ b/drivers/leds/leds-tca6507.c > @@ -682,7 +682,7 @@ tca6507_led_dt_init(struct i2c_client *client) > return ERR_PTR(-ENODEV); > > tca_leds = devm_kzalloc(&client->dev, > - sizeof(struct led_info) * count, GFP_KERNEL); > + sizeof(struct led_info) * NUM_LEDS, GFP_KERNEL); > if (!tca_leds) > return ERR_PTR(-ENOMEM); > > @@ -695,9 +695,9 @@ tca6507_led_dt_init(struct i2c_client *client) > of_get_property(child, "label", NULL) ? : child->name; > led.default_trigger = > of_get_property(child, "linux,default-trigger", NULL); > - > + led.flags = 0; > ret = of_property_read_u32(child, "reg", ®); > - if (ret != 0) > + if (ret != 0 || reg < 0 || reg >= NUM_LEDS) > continue; > > tca_leds[reg] = led; > @@ -708,7 +708,7 @@ tca6507_led_dt_init(struct i2c_client *client) > return ERR_PTR(-ENOMEM); > > pdata->leds.leds = tca_leds; > - pdata->leds.num_leds = count; > + pdata->leds.num_leds = NUM_LEDS; > > return pdata; > } -- To unsubscribe from this list: send the line "unsubscribe linux-leds" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
