[v1] gpio: Avoid NULL dereference in linehandle_create()

[PATCH] gpio: Avoid NULL dereference in linehandle_create()

Posted by Douglas Anderson 1 month, 2 weeks ago

In linehandle_create(), there is a statement like this:
  retain_and_null_ptr(lh);

Soon after, there is a debug printout that dereferences "lh", which
will crash things.

Avoid the crash by reading value needed by the printout before making
"lh" NULL.

Fixes: da7e394bf58f ("gpio: convert linehandle_create() to FD_PREPARE()")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
---

 drivers/gpio/gpiolib-cdev.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c
index 2adc3c070908..13ab6a5ebb76 100644
--- a/drivers/gpio/gpiolib-cdev.c
+++ b/drivers/gpio/gpiolib-cdev.c
@@ -304,6 +304,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
 {
 	struct gpiohandle_request handlereq;
 	struct linehandle_state *lh __free(linehandle_free) = NULL;
+	u32 num_descs;
 	int i, ret;
 	u32 lflags;
 
@@ -379,6 +380,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
 				      lh, O_RDONLY | O_CLOEXEC));
 	if (fdf.err)
 		return fdf.err;
+	num_descs = lh->num_descs;
 	retain_and_null_ptr(lh);
 
 	handlereq.fd = fd_prepare_fd(fdf);
@@ -388,7 +390,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
 	fd_publish(fdf);
 
 	dev_dbg(&gdev->dev, "registered chardev handle for %d lines\n",
-		lh->num_descs);
+		num_descs);
 
 	return 0;
 }
-- 
2.53.0.273.g2a3d683680-goog

Re: [PATCH] gpio: Avoid NULL dereference in linehandle_create()

Posted by Kent Gibson 1 month, 2 weeks ago

On Fri, Feb 13, 2026 at 09:29:31AM -0800, Douglas Anderson wrote:
> In linehandle_create(), there is a statement like this:
>   retain_and_null_ptr(lh);
> 
> Soon after, there is a debug printout that dereferences "lh", which
> will crash things.
> 
> Avoid the crash by reading value needed by the printout before making
> "lh" NULL.
> 
> Fixes: da7e394bf58f ("gpio: convert linehandle_create() to FD_PREPARE()")
> Signed-off-by: Douglas Anderson <dianders@chromium.org>
> ---
> 
>  drivers/gpio/gpiolib-cdev.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c
> index 2adc3c070908..13ab6a5ebb76 100644
> --- a/drivers/gpio/gpiolib-cdev.c
> +++ b/drivers/gpio/gpiolib-cdev.c
> @@ -304,6 +304,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
>  {
>  	struct gpiohandle_request handlereq;
>  	struct linehandle_state *lh __free(linehandle_free) = NULL;
> +	u32 num_descs;
>  	int i, ret;
>  	u32 lflags;
>  
> @@ -379,6 +380,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
>  				      lh, O_RDONLY | O_CLOEXEC));
>  	if (fdf.err)
>  		return fdf.err;
> +	num_descs = lh->num_descs;
>  	retain_and_null_ptr(lh);
>  
>  	handlereq.fd = fd_prepare_fd(fdf);
> @@ -388,7 +390,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
>  	fd_publish(fdf);
>  
>  	dev_dbg(&gdev->dev, "registered chardev handle for %d lines\n",
> -		lh->num_descs);
> +		num_descs);
>  

Use handlereq.lines rather than creating another local shadow.

Cheers,
Kent.