Patch "leds: gpio: Set num_leds after allocation" has been added to the 6.11-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    leds: gpio: Set num_leds after allocation

to the 6.11-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     leds-gpio-set-num_leds-after-allocation.patch
and it can be found in the queue-6.11 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 164ff0a95bc03c9516657a0e09ec402f30efe0f1
Author: Kees Cook <kees@xxxxxxxxxx>
Date:   Tue Jul 16 14:24:59 2024 -0700

    leds: gpio: Set num_leds after allocation
    
    [ Upstream commit 045391a02bd971d431c83ad03f7cc51b6e2fe331 ]
    
    With the new __counted_by annotation, the "num_leds" variable needs to
    valid for accesses to the "leds" array. This requirement is not met in
    gpio_leds_create(), since "num_leds" starts at "0", so "leds" index "0"
    will not be considered valid (num_leds would need to be "1" to access
    index "0").
    
    Fix this by setting the allocation size after allocation, and then update
    the final count based on how many were actually added to the array.
    
    Fixes: 52cd75108a42 ("leds: gpio: Annotate struct gpio_leds_priv with __counted_by")
    Signed-off-by: Kees Cook <kees@xxxxxxxxxx>
    Reviewed-by: Gustavo A. R. Silva <gustavoars@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240716212455.work.809-kees@xxxxxxxxxx
    Signed-off-by: Lee Jones <lee@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/leds/leds-gpio.c b/drivers/leds/leds-gpio.c
index 83fcd7b6afff7..4d1612d557c84 100644
--- a/drivers/leds/leds-gpio.c
+++ b/drivers/leds/leds-gpio.c
@@ -150,7 +150,7 @@ static struct gpio_leds_priv *gpio_leds_create(struct device *dev)
 {
 	struct fwnode_handle *child;
 	struct gpio_leds_priv *priv;
-	int count, ret;
+	int count, used, ret;
 
 	count = device_get_child_node_count(dev);
 	if (!count)
@@ -159,9 +159,11 @@ static struct gpio_leds_priv *gpio_leds_create(struct device *dev)
 	priv = devm_kzalloc(dev, struct_size(priv, leds, count), GFP_KERNEL);
 	if (!priv)
 		return ERR_PTR(-ENOMEM);
+	priv->num_leds = count;
+	used = 0;
 
 	device_for_each_child_node(dev, child) {
-		struct gpio_led_data *led_dat = &priv->leds[priv->num_leds];
+		struct gpio_led_data *led_dat = &priv->leds[used];
 		struct gpio_led led = {};
 
 		/*
@@ -197,8 +199,9 @@ static struct gpio_leds_priv *gpio_leds_create(struct device *dev)
 		/* Set gpiod label to match the corresponding LED name. */
 		gpiod_set_consumer_name(led_dat->gpiod,
 					led_dat->cdev.dev->kobj.name);
-		priv->num_leds++;
+		used++;
 	}
+	priv->num_leds = used;
 
 	return priv;
 }