gpio: shared: fix NULL-pointer dereference in teardown path

We need to actually store the address of the GPIO lookup table in the
reference struct before we try to free it or - worse - dereference its
members.

Fixes: a060b8c511ab ("gpiolib: implement low-level, shared GPIO support")
Link: https://lore.kernel.org/r/20251206-gpio-shared-teardown-fixes-v1-1-35ac458cfce1@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

diff --git a/drivers/gpio/gpiolib-shared.c b/drivers/gpio/gpiolib-shared.c
index 5d15675d61ea52b21a8181ef9a93123774b8e7c3..17da15c1075f97f4ebed969b38197ac155141406 100644 (file)
--- a/drivers/gpio/gpiolib-shared.c
+++ b/drivers/gpio/gpiolib-shared.c
@@ -399,7 +399,8 @@ int gpio_shared_add_proxy_lookup(struct device *consumer, unsigned long lflags)
                        lookup->table[0] = GPIO_LOOKUP(no_free_ptr(key), 0,
                                                       ref->con_id, lflags);
 
-                       gpiod_add_lookup_table(no_free_ptr(lookup));
+                       ref->lookup = no_free_ptr(lookup);
+                       gpiod_add_lookup_table(ref->lookup);
 
                        return 0;
                }