summaryrefslogtreecommitdiffstats
path: root/drivers/gpio
diff options
context:
space:
mode:
authorKent Gibson <warthog618@gmail.com>2022-07-06 16:45:07 +0800
committerBartosz Golaszewski <brgl@bgdev.pl>2022-07-07 12:18:18 +0200
commitc8e27a4a5136e7230f9e4ffcf132705bf56864cc (patch)
tree76b9c9125ccfb8459b96efd4e84951ac978adc9e /drivers/gpio
parent8af3a0b23818af59971f538bf258c15e1033ea55 (diff)
downloadlinux-c8e27a4a5136e7230f9e4ffcf132705bf56864cc.tar.bz2
gpiolib: cdev: fix null pointer dereference in linereq_free()
Fix a kernel NULL pointer dereference reported by gpio kselftests. linereq_free() can be called as part of the cleanup of a failed request, at which time the desc for a line may not have been determined, so it is unsafe to dereference without a check. Add a check prior to dereferencing the line desc. Fixes: 2068339a6c35 ("gpiolib: cdev: Add hardware timestamp clock type") Signed-off-by: Kent Gibson <warthog618@gmail.com> Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
Diffstat (limited to 'drivers/gpio')
-rw-r--r--drivers/gpio/gpiolib-cdev.c7
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c
index f5aa5f93342a..0c9a63becfef 100644
--- a/drivers/gpio/gpiolib-cdev.c
+++ b/drivers/gpio/gpiolib-cdev.c
@@ -1460,11 +1460,12 @@ static ssize_t linereq_read(struct file *file,
static void linereq_free(struct linereq *lr)
{
unsigned int i;
- bool hte;
+ bool hte = false;
for (i = 0; i < lr->num_lines; i++) {
- hte = !!test_bit(FLAG_EVENT_CLOCK_HTE,
- &lr->lines[i].desc->flags);
+ if (lr->lines[i].desc)
+ hte = !!test_bit(FLAG_EVENT_CLOCK_HTE,
+ &lr->lines[i].desc->flags);
edge_detector_stop(&lr->lines[i], hte);
if (lr->lines[i].desc)
gpiod_free(lr->lines[i].desc);