Commit e2c4175b authored by Bartosz Golaszewski's avatar Bartosz Golaszewski
Browse files

gpio: shared: fix NULL-pointer dereference in teardown path 

We need to actually store the address of the GPIO lookup table in the
reference struct before we try to free it or - worse - dereference its
members.

Fixes: a060b8c5 ("gpiolib: implement low-level, shared GPIO support")
Link: https://lore.kernel.org/r/20251206-gpio-shared-teardown-fixes-v1-1-35ac458cfce1@oss.qualcomm.com


Signed-off-by: default avatarBartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
parent 9e7a40a2

drivers/gpio/gpiolib-shared.c

+2 −1
Original line number Diff line number Diff line
@@ -399,7 +399,8 @@ int gpio_shared_add_proxy_lookup(struct device *consumer, unsigned long lflags) 
			lookup->table[0] = GPIO_LOOKUP(no_free_ptr(key), 0,

						       ref->con_id, lflags);



			gpiod_add_lookup_table(no_free_ptr(lookup));

			ref->lookup = no_free_ptr(lookup);

			gpiod_add_lookup_table(ref->lookup);



			return 0;

		}