Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b5c8314f authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'led-fixes-for-5.1-rc3' of... 

Merge tag 'led-fixes-for-5.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds

Pull LED fixes from Jacek Anaszewski:

 - fix refcnt leak on interface rename

 - use memcpy in device_name_store() to avoid including garbage from a
   previous, longer value in the device_name

 - fix a potential NULL pointer dereference in case of_match_device()
   cannot find a match

* tag 'led-fixes-for-5.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds:
  leds: trigger: netdev: use memcpy in device_name_store
  leds: pca9532: fix a potential NULL pointer dereference
  leds: trigger: netdev: fix refcnt leak on interface rename
parents 3af9a525 90934643

drivers/leds/leds-pca9532.c

+6 −2
Original line number Diff line number Diff line
@@ -513,6 +513,7 @@ static int pca9532_probe(struct i2c_client *client, 
	const struct i2c_device_id *id)

{

	int devid;

	const struct of_device_id *of_id;

	struct pca9532_data *data = i2c_get_clientdata(client);

	struct pca9532_platform_data *pca9532_pdata =

			dev_get_platdata(&client->dev);
@@ -528,8 +529,11 @@ static int pca9532_probe(struct i2c_client *client, 
			dev_err(&client->dev, "no platform data\n");

			return -EINVAL;

		}

		devid = (int)(uintptr_t)of_match_device(

			of_pca9532_leds_match, &client->dev)->data;

		of_id = of_match_device(of_pca9532_leds_match,

				&client->dev);

		if (unlikely(!of_id))

			return -EINVAL;

		devid = (int)(uintptr_t) of_id->data;

	} else {

		devid = id->driver_data;

	}

drivers/leds/trigger/ledtrig-netdev.c

+7 −9
Original line number Diff line number Diff line
@@ -122,7 +122,8 @@ static ssize_t device_name_store(struct device *dev, 
		trigger_data->net_dev = NULL;

	}



	strncpy(trigger_data->device_name, buf, size);

	memcpy(trigger_data->device_name, buf, size);

	trigger_data->device_name[size] = 0;

	if (size > 0 && trigger_data->device_name[size - 1] == '\n')

		trigger_data->device_name[size - 1] = 0;
@@ -301,11 +302,11 @@ static int netdev_trig_notify(struct notifier_block *nb, 
		container_of(nb, struct led_netdev_data, notifier);



	if (evt != NETDEV_UP && evt != NETDEV_DOWN && evt != NETDEV_CHANGE

	    && evt != NETDEV_REGISTER && evt != NETDEV_UNREGISTER

	    && evt != NETDEV_CHANGENAME)

	    && evt != NETDEV_REGISTER && evt != NETDEV_UNREGISTER)

		return NOTIFY_DONE;



	if (strcmp(dev->name, trigger_data->device_name))

	if (!(dev == trigger_data->net_dev ||

	      (evt == NETDEV_REGISTER && !strcmp(dev->name, trigger_data->device_name))))

		return NOTIFY_DONE;



	cancel_delayed_work_sync(&trigger_data->work);
@@ -320,12 +321,9 @@ static int netdev_trig_notify(struct notifier_block *nb, 
		dev_hold(dev);

		trigger_data->net_dev = dev;

		break;

	case NETDEV_CHANGENAME:

	case NETDEV_UNREGISTER:

		if (trigger_data->net_dev) {

		dev_put(trigger_data->net_dev);

		trigger_data->net_dev = NULL;

		}

		break;

	case NETDEV_UP:

	case NETDEV_CHANGE: