Armin WolfandGreg Kroah-Hartman 5ad6f6c920 leds: uleds: Fix potential buffer overread ...

commit c19fe864f6 upstream.

The name string supplied by userspace is not guaranteed to be
null-terminated, so using strchr() on it might result in a buffer
overread. The same thing will happen when said string is used by
the LED class device.

Fix this by using strnchr() instead and explicitly check that
the name string is properly null-terminated.

Cc: stable@vger.kernel.org
Fixes: e381322b01 ("leds: Introduce userspace LED class driver")
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260524235553.189134-1-W_Armin@gmx.de
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-07-24 15:55:00 +02:00

..

blink

leds: lgm-sso: Remove duplicate assignments for priv->mmap

2026-06-01 17:39:19 +02:00

flash

leds: Replace all non-returning strlcpy with strscpy

2026-01-11 15:18:13 +01:00

rgb

leds: qcom-lpg: Check the return value of regmap_bulk_write()

2026-03-04 07:20:00 -05:00

simple

…

trigger

leds: triggers: Flush pending brightness before activating trigger

2024-08-11 12:35:53 +02:00

Kconfig

…

led-class-flash.c

…

led-class-multicolor.c

leds: multicolor: Fix intensity setting while SW blinking

2025-07-06 10:57:54 +02:00

led-class.c

leds: led-class: Only Add LED to leds_list when it is fully ready

2026-02-06 16:44:11 +01:00

led-core.c

…

led-triggers.c

leds: triggers: Flush pending brightness before activating trigger

2024-08-11 12:35:53 +02:00

leds-88pm860x.c

…

leds-acer-a500.c

…

leds-adp5520.c

…

leds-an30259a.c

…

leds-apu.c

…

leds-ariel.c

…

leds-asic3.c

…

leds-aw2013.c

…

leds-bcm6328.c

…

leds-bcm6358.c

…

leds-bd2802.c

…

leds-blinkm.c

…

leds-clevo-mail.c

…

leds-cobalt-qube.c

…

leds-cobalt-raq.c

…

leds-cpcap.c

…

leds-cr0014114.c

…

leds-da903x.c

…

leds-da9052.c

…

leds-dac124s085.c

…

leds-el15203000.c

…

leds-gpio-register.c

…

leds-gpio.c

…

leds-hp6xx.c

…

leds-ip30.c

…

leds-ipaq-micro.c

…

leds-is31fl32xx.c

…

leds-is31fl319x.c

…

leds-lm355x.c

…

leds-lm3530.c

…

leds-lm3532.c

…

leds-lm3533.c

…

leds-lm3642.c

…

leds-lm3692x.c

…

leds-lm3697.c

…

leds-lm36274.c

…

leds-locomo.c

…

leds-lp50xx.c

leds: leds-lp50xx: Enable chip before any communication

2026-01-11 15:19:07 +01:00

leds-lp55xx-common.c

leds: lp55xx: Remove redundant test for invalid channel number

2024-12-14 19:54:13 +01:00

leds-lp55xx-common.h

…

leds-lp3944.c

…

leds-lp3952.c

…

leds-lp5521.c

…

leds-lp5523.c

…

leds-lp5562.c

…

leds-lp8501.c

…

leds-lp8788.c

…

leds-lp8860.c

leds: lp8860: Write full EEPROM, not only half of it

2025-02-21 13:49:38 +01:00

leds-lt3593.c

…

leds-max8997.c

…

leds-max77650.c

…

leds-mc13783.c

…

leds-menf21bmc.c

…

leds-mlxcpld.c

…

leds-mlxreg.c

leds: mlxreg: Use devm_mutex_init() for mutex initialization

2025-03-28 21:58:57 +01:00

leds-mt6323.c

…

leds-net48xx.c

…

leds-netxbig.c

leds: netxbig: Fix GPIO descriptor leak in error paths

2026-01-11 15:18:25 +01:00

leds-nic78bx.c

…

leds-ns2.c

…

leds-ot200.c

…

leds-pca955x.c

…

leds-pca963x.c

…

leds-pca9532.c

…

leds-pm8058.c

…

leds-powernv.c

…

leds-pwm.c

…

leds-rb532.c

…

leds-regulator.c

…

leds-s3c24xx.c

…

leds-sc27xx-bltc.c

…

leds-spi-byte.c

leds: spi-byte: Use devm_led_classdev_register_ext()

2026-01-11 15:18:13 +01:00

leds-ss4200.c

leds: ss4200: Convert PCIBIOS_* return codes to errnos

2024-08-03 08:49:35 +02:00

leds-sunfire.c

…

leds-syscon.c

…

leds-tca6507.c

…

leds-ti-lmu-common.c

…

leds-tlc591xx.c

…

leds-tps6105x.c

…

leds-turris-omnia.c

…

leds-wm831x-status.c

…

leds-wm8350.c

…

leds-wrap.c

…

leds.h

…

Makefile

…

TODO

…

uleds.c

leds: uleds: Fix potential buffer overread

2026-07-24 15:55:00 +02:00