Re: [PATCH v6 8/9] leds: st1202: validate LED reg property against channel count

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The driver saves an unreferenced `fwnode` pointer from an OF iterator, leading to a potential use-after-free when registering the LED device.
--

commit c706b102612aa127883dfb65d961c6ac4e7aa123
Author: Manuel Fombuena <[email protected]>

leds: st1202: validate LED reg property against channel count

This commit adds bounds checking for the reg property parsed from the device
tree. It ensures the value is within the ST1202_MAX_LEDS limit to prevent
out-of-bounds writes into the chip->leds array during probe.

> diff --git a/drivers/leds/leds-st1202.c b/drivers/leds/leds-st1202.c
> --- a/drivers/leds/leds-st1202.c
> +++ b/drivers/leds/leds-st1202.c
[ ... ]
> @@ -279,13 +279,19 @@ static int st1202_dt_init(struct st1202_chip *chip)
[ ... ]
>  		if (reg >= ST1202_MAX_LEDS)
>  			return dev_err_probe(dev, -EINVAL,
>  					"LED reg %u out of range [0, %d]\n",
>  					reg, ST1202_MAX_LEDS - 1);
>  
>  		led = &chip->leds[reg];
>  		led->is_active = true;
>  		led->fwnode = of_fwnode_handle(child);

[Severity: High]
This isn't a bug introduced by this patch, but does st1202_dt_init() save
an unreferenced fwnode pointer here?

The scoped iterator for_each_available_child_of_node_scoped() automatically
drops the reference to the child node when the loop advances or exits. Because
the driver does not explicitly acquire a reference via fwnode_handle_get() or
of_node_get(), the saved pointer becomes unreferenced.

If the device tree node is dynamically removed (for example, via DT overlay
removal) after the loop finishes, its memory will be freed. Later in
st1202_probe(), devm_led_classdev_register_ext() calls device_add(), which
dereferences dev->fwnode and attempts to increment its reference count,
resulting in a use-after-free.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/GV1PR08MB84972A16ED557BFB96D63F57C5F52@GV1PR08MB8497.eurprd08.prod.outlook.com?part=8