diff options
| author | Douglas Anderson <dianders@chromium.org> | 2026-02-15 12:05:55 -0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-02-26 15:01:36 -0800 |
| commit | 87b9d7a4cfbed5f42af440372026270af997c766 (patch) | |
| tree | 1a47bd7a4d46b2d7fbb35c2d012ce1eb97fd1ca9 /drivers/gpio | |
| parent | cb9b2dc34a9eef0855edb00ae9c9b7f72394281b (diff) | |
gpio: cdev: Avoid NULL dereference in linehandle_create()
[ Upstream commit 6af6be278e3ba2ffb6af5b796c89dfb3f5d9063e ]
In linehandle_create(), there is a statement like this:
retain_and_null_ptr(lh);
Soon after, there is a debug printout that dereferences "lh", which
will crash things.
Avoid the crash by using handlereq.lines, which is the same value.
Fixes: da7e394bf58f ("gpio: convert linehandle_create() to FD_PREPARE()")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://patch.msgid.link/20260215120555.v2.1.I77c3eb563271c21870379eefd16ebbc4e09635bb@changeid
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/gpio')
| -rw-r--r-- | drivers/gpio/gpiolib-cdev.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c index 2adc3c070908..189127721e38 100644 --- a/drivers/gpio/gpiolib-cdev.c +++ b/drivers/gpio/gpiolib-cdev.c @@ -388,7 +388,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip) fd_publish(fdf); dev_dbg(&gdev->dev, "registered chardev handle for %d lines\n", - lh->num_descs); + handlereq.lines); return 0; } |