leds: gpio: Set num_leds after allocation

With the new __counted_by annotation, the "num_leds" variable needs to valid for accesses to the "leds" array. This requirement is not met in gpio_leds_create(), since "num_leds" starts at "0", so "leds" index "0" will not be considered valid (num_leds would need to be "1" to access index "0").

Fix this by setting the allocation size after allocation, and then update the final count based on how many were actually added to the array.

Fixes 52cd75108a42 ("leds: gpio: Annotate struct gpio_leds_priv with __counted_by")

Signed-off-by Kees Cook <[email protected]>

---
Cc: Lee Jones <[email protected]>
Cc: Pavel Machek <[email protected]>
Cc: [email protected]

---
  drivers/leds/leds-gpio.c | 9 ++++++---
  1 file changed, 6 insertions(+), 3 deletions(-)

drivers/leds/leds-gpio.c +6 -3

index 83fcd7b6afff..4d1612d557c8 100644
@@ -150,7 +150,7 @@ static struct gpio_leds_priv *gpio_leds_create(struct device *dev)
  {
  	struct fwnode_handle *child;
  	struct gpio_leds_priv *priv;
-	int count, ret;
+	int count, used, ret;
 
  	count = device_get_child_node_count(dev);
  	if (!count)

@@ -159,9 +159,11 @@ static struct gpio_leds_priv *gpio_leds_create(struct device *dev)
  	priv = devm_kzalloc(dev, struct_size(priv, leds, count), GFP_KERNEL);
  	if (!priv)
  		return ERR_PTR(-ENOMEM);
+	priv->num_leds = count;
+	used = 0;
 
  	device_for_each_child_node(dev, child) {
-		struct gpio_led_data *led_dat = &priv->leds[priv->num_leds];
+		struct gpio_led_data *led_dat = &priv->leds[used];
  		struct gpio_led led = {};
 
  		/*

@@ -197,8 +199,9 @@ static struct gpio_leds_priv *gpio_leds_create(struct device *dev)
  		/* Set gpiod label to match the corresponding LED name. */
  		gpiod_set_consumer_name(led_dat->gpiod,
  					led_dat->cdev.dev->kobj.name);
-		priv->num_leds++;
+		used++;
  	}
+	priv->num_leds = used;
 
  	return priv;
  }

Quoted 9 lines · Kees Cook

With the new __counted_by annotation, the "num_leds" variable needs to valid for accesses to the "leds" array. This requirement is not met in gpio_leds_create(), since "num_leds" starts at "0", so "leds" index "0" will not be considered valid (num_leds would need to be "1" to access index "0").

Fix this by setting the allocation size after allocation, and then update the final count based on how many were actually added to the array.

Quoted 2 lines

Fixes 52cd75108a42 ("leds: gpio: Annotate struct gpio_leds_priv with __counted_by")

Signed-off-by Kees Cook <[email protected]>

Reviewed-by Gustavo A. R. Silva <[email protected]>

Thanks

Gustavo

Quoted 41 lines

---
Cc: Lee Jones <[email protected]>
Cc: Pavel Machek <[email protected]>
Cc: [email protected]

---
  drivers/leds/leds-gpio.c | 9 ++++++---
  1 file changed, 6 insertions(+), 3 deletions(-)

drivers/leds/leds-gpio.c +6 -3

index 83fcd7b6afff..4d1612d557c8 100644
@@ -150,7 +150,7 @@ static struct gpio_leds_priv *gpio_leds_create(struct device *dev)
  {
  	struct fwnode_handle *child;
  	struct gpio_leds_priv *priv;
-	int count, ret;
+	int count, used, ret;
  	count = device_get_child_node_count(dev);
  	if (!count)

@@ -159,9 +159,11 @@ static struct gpio_leds_priv *gpio_leds_create(struct device *dev)
  	priv = devm_kzalloc(dev, struct_size(priv, leds, count), GFP_KERNEL);
  	if (!priv)
  		return ERR_PTR(-ENOMEM);
+	priv->num_leds = count;
+	used = 0;
  	device_for_each_child_node(dev, child) {
-		struct gpio_led_data *led_dat = &priv->leds[priv->num_leds];
+		struct gpio_led_data *led_dat = &priv->leds[used];
  		struct gpio_led led = {};
  		/*

@@ -197,8 +199,9 @@ static struct gpio_leds_priv *gpio_leds_create(struct device *dev)
  		/* Set gpiod label to match the corresponding LED name. */
  		gpiod_set_consumer_name(led_dat->gpiod,
  					led_dat->cdev.dev->kobj.name);
-		priv->num_leds++;
+		used++;
  	}
+	priv->num_leds = used;
  	return priv;
  }

Quoted 17 lines · Gustavo A. R. Silva

Quoted 11 lines · Kees Cook

With the new __counted_by annotation, the "num_leds" variable needs to valid for accesses to the "leds" array. This requirement is not met in gpio_leds_create(), since "num_leds" starts at "0", so "leds" index "0" will not be considered valid (num_leds would need to be "1" to access index "0").

Fix this by setting the allocation size after allocation, and then update the final count based on how many were actually added to the array.

Fixes 52cd75108a42 ("leds: gpio: Annotate struct gpio_leds_priv with __counted_by")

Signed-off-by Kees Cook <[email protected]>

Reviewed-by Gustavo A. R. Silva <[email protected]>

Quoted 2 lines

Thanks

Using the signature tag in the middle of an email turns the remainder of the body into a signature block, which is odd to say the least. By all means sign-off in the middle of a mail, but please refrain from converting the rest of the mail.

With the new __counted_by annotation, the "num_leds" variable needs to valid for accesses to the "leds" array. This requirement is not met in gpio_leds_create(), since "num_leds" starts at "0", so "leds" index "0" will not be considered valid (num_leds would need to be "1" to access index "0").

Fix this by setting the allocation size after allocation, and then update the final count based on how many were actually added to the array.

[...]

Quoted 22 lines · Lee Jones

Quoted 19 lines · Gustavo A. R. Silva

Quoted 11 lines · Kees Cook

With the new __counted_by annotation, the "num_leds" variable needs to valid for accesses to the "leds" array. This requirement is not met in gpio_leds_create(), since "num_leds" starts at "0", so "leds" index "0" will not be considered valid (num_leds would need to be "1" to access index "0").

Fix this by setting the allocation size after allocation, and then update the final count based on how many were actually added to the array.

Fixes 52cd75108a42 ("leds: gpio: Annotate struct gpio_leds_priv with __counted_by")

Signed-off-by Kees Cook <[email protected]>

Reviewed-by Gustavo A. R. Silva <[email protected]>

Thanks

Quoted 4 lines

Using the signature tag in the middle of an email turns the remainder of the body into a signature block, which is odd to say the least. By all means sign-off in the middle of a mail, but please refrain from converting the rest of the mail.

Ping. Shall I take this via the hardening tree?