diff options
| author | Bartosz Golaszewski <bartosz.golaszewski@linaro.org> | 2025-11-03 15:11:32 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-11-13 15:34:37 -0500 |
| commit | 70180a6031056096c93ed2f47c41803268bdd91c (patch) | |
| tree | 9ed17e43deb871230aee439f2bf1a70a0cd16f4e | |
| parent | 5a0aca55e84d931ea0bda8e3ea4bc036784b7eeb (diff) | |
| download | linux-70180a6031056096c93ed2f47c41803268bdd91c.tar.gz linux-70180a6031056096c93ed2f47c41803268bdd91c.tar.bz2 linux-70180a6031056096c93ed2f47c41803268bdd91c.zip | |
gpiolib: fix invalid pointer access in debugfs
[ Upstream commit 2f6115ad8864cf3f48598f26c74c7c8e5c391919 ]
If the memory allocation in gpiolib_seq_start() fails, the s->private
field remains uninitialized and is later dereferenced without checking
in gpiolib_seq_stop(). Initialize s->private to NULL before calling
kzalloc() and check it before dereferencing it.
Fixes: e348544f7994 ("gpio: protect the list of GPIO devices with SRCU")
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20251103141132.53471-1-brgl@bgdev.pl
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/gpio/gpiolib.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c index e5d0d2b0d798..967ff661e4c9 100644 --- a/drivers/gpio/gpiolib.c +++ b/drivers/gpio/gpiolib.c @@ -4997,6 +4997,8 @@ static void *gpiolib_seq_start(struct seq_file *s, loff_t *pos) struct gpio_device *gdev; loff_t index = *pos; + s->private = NULL; + priv = kzalloc(sizeof(*priv), GFP_KERNEL); if (!priv) return NULL; @@ -5030,7 +5032,11 @@ static void *gpiolib_seq_next(struct seq_file *s, void *v, loff_t *pos) static void gpiolib_seq_stop(struct seq_file *s, void *v) { - struct gpiolib_seq_priv *priv = s->private; + struct gpiolib_seq_priv *priv; + + priv = s->private; + if (!priv) + return; srcu_read_unlock(&gpio_devices_srcu, priv->idx); kfree(priv); |