Skip to content

Commit 2f6115a

Browse files
author
Bartosz Golaszewski
committed
gpiolib: fix invalid pointer access in debugfs
If the memory allocation in gpiolib_seq_start() fails, the s->private field remains uninitialized and is later dereferenced without checking in gpiolib_seq_stop(). Initialize s->private to NULL before calling kzalloc() and check it before dereferencing it. Fixes: e348544 ("gpio: protect the list of GPIO devices with SRCU") Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://lore.kernel.org/r/20251103141132.53471-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
1 parent e5d527b commit 2f6115a

1 file changed

Lines changed: 7 additions & 1 deletion

File tree

drivers/gpio/gpiolib.c

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5296,6 +5296,8 @@ static void *gpiolib_seq_start(struct seq_file *s, loff_t *pos)
52965296
struct gpio_device *gdev;
52975297
loff_t index = *pos;
52985298

5299+
s->private = NULL;
5300+
52995301
priv = kzalloc(sizeof(*priv), GFP_KERNEL);
53005302
if (!priv)
53015303
return NULL;
@@ -5329,7 +5331,11 @@ static void *gpiolib_seq_next(struct seq_file *s, void *v, loff_t *pos)
53295331

53305332
static void gpiolib_seq_stop(struct seq_file *s, void *v)
53315333
{
5332-
struct gpiolib_seq_priv *priv = s->private;
5334+
struct gpiolib_seq_priv *priv;
5335+
5336+
priv = s->private;
5337+
if (!priv)
5338+
return;
53335339

53345340
srcu_read_unlock(&gpio_devices_srcu, priv->idx);
53355341
kfree(priv);

0 commit comments

Comments
 (0)