Received-SPF: pass (google.com: domain of linux-kernel+bounces-91904-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Precedence: bulk
MIME-Version: 1.0
References: <20240305035853.916430-1-chris.packham@alliedtelesis.co.nz> <20240305035853.916430-2-chris.packham@alliedtelesis.co.nz>
In-Reply-To: <20240305035853.916430-2-chris.packham@alliedtelesis.co.nz>
From: Geert Uytterhoeven <geert@linux-m68k.org>
Date: Tue, 5 Mar 2024 09:23:07 +0100
Message-ID: <CAMuHMdXF+12PHa5A7WeyPMfvsGcJN13WaPuCbTmJU52Huq=osA@mail.gmail.com>
Subject: Re: [PATCH v4 1/3] auxdisplay: Add 7-segment LED display driver
To: Chris Packham <chris.packham@alliedtelesis.co.nz>
Cc: andy@kernel.org, robh+dt@kernel.org, krzysztof.kozlowski+dt@linaro.org, 
	conor+dt@kernel.org, andrew@lunn.ch, gregory.clement@bootlin.com, 
	sebastian.hesselbarth@gmail.com, lee@kernel.org, devicetree@vger.kernel.org, 
	linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, 
	linux-leds@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Chris,

On Tue, Mar 5, 2024 at 4:59=E2=80=AFAM Chris Packham
<chris.packham@alliedtelesis.co.nz> wrote:
> Add a driver for a 7-segment LED display. At the moment only one
> character is supported but it should be possible to expand this to
> support more characters and/or 14-segment displays in the future.
>
> Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>

Sorry, I spoke too soon...

> --- /dev/null
> +++ b/drivers/auxdisplay/seg-led-gpio.c

> +static void seg_led_update(struct work_struct *work)
> +{
> +       struct seg_led_priv *priv =3D container_of(work, struct seg_led_p=
riv, work.work);
> +       struct linedisp *linedisp =3D &priv->linedisp;
> +       struct linedisp_map *map =3D linedisp->map;
> +       DECLARE_BITMAP(values, 8) =3D { 0 };
> +
> +       bitmap_set_value8(values, map_to_seg7(&map->map.seg7, linedisp->b=
uf[0]), 0);
> +
> +       gpiod_set_array_value_cansleep(priv->segment_gpios->ndescs, priv-=
>segment_gpios->desc,
> +                                      priv->segment_gpios->info, values)=
;
> +}

> +static int seg_led_probe(struct platform_device *pdev)
> +{
> +       struct seg_led_priv *priv;
> +       struct device *dev =3D &pdev->dev;
> +
> +       priv =3D devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
> +       if (!priv)
> +               return -ENOMEM;
> +
> +       platform_set_drvdata(pdev, priv);
> +
> +       priv->segment_gpios =3D devm_gpiod_get_array(dev, "segment", GPIO=
D_OUT_LOW);
> +       if (IS_ERR(priv->segment_gpios))
> +               return PTR_ERR(priv->segment_gpios);

This needs some validation of priv->segment_gpios->ndescs, else the
call to gpiod_set_array_value_cansleep() in seg_led_update() may
trigger an out-of-bounds access of the values bitmap.

> +
> +       return linedisp_register(&priv->linedisp, dev, 1, &seg_led_linedi=
sp_ops);
> +}

Gr{oetje,eeting}s,

                        Geert

--=20
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k=
org

In personal conversations with technical people, I call myself a hacker. Bu=
t
when I'm talking to journalists I just say "programmer" or something like t=
hat.
                                -- Linus Torvalds