From: Bartosz Golaszewski Date: Sat, 6 Dec 2025 11:53:53 +0000 (+0100) Subject: gpio: shared: fix NULL-pointer dereference in teardown path X-Git-Tag: v6.19-rc1~17^2~3 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e2c4175b8d3b3ea65fc3801c190bd93fe8b7a7a9;p=thirdparty%2Fkernel%2Flinux.git gpio: shared: fix NULL-pointer dereference in teardown path We need to actually store the address of the GPIO lookup table in the reference struct before we try to free it or - worse - dereference its members. Fixes: a060b8c511ab ("gpiolib: implement low-level, shared GPIO support") Link: https://lore.kernel.org/r/20251206-gpio-shared-teardown-fixes-v1-1-35ac458cfce1@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski --- diff --git a/drivers/gpio/gpiolib-shared.c b/drivers/gpio/gpiolib-shared.c index 5d15675d61ea..17da15c1075f 100644 --- a/drivers/gpio/gpiolib-shared.c +++ b/drivers/gpio/gpiolib-shared.c @@ -399,7 +399,8 @@ int gpio_shared_add_proxy_lookup(struct device *consumer, unsigned long lflags) lookup->table[0] = GPIO_LOOKUP(no_free_ptr(key), 0, ref->con_id, lflags); - gpiod_add_lookup_table(no_free_ptr(lookup)); + ref->lookup = no_free_ptr(lookup); + gpiod_add_lookup_table(ref->lookup); return 0; }