From e2c4175b8d3b3ea65fc3801c190bd93fe8b7a7a9 Mon Sep 17 00:00:00 2001 From: Bartosz Golaszewski Date: Sat, 6 Dec 2025 12:53:53 +0100 Subject: [PATCH] gpio: shared: fix NULL-pointer dereference in teardown path We need to actually store the address of the GPIO lookup table in the reference struct before we try to free it or - worse - dereference its members. Fixes: a060b8c511ab ("gpiolib: implement low-level, shared GPIO support") Link: https://lore.kernel.org/r/20251206-gpio-shared-teardown-fixes-v1-1-35ac458cfce1@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski --- drivers/gpio/gpiolib-shared.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpio/gpiolib-shared.c b/drivers/gpio/gpiolib-shared.c index 5d15675d61ea..17da15c1075f 100644 --- a/drivers/gpio/gpiolib-shared.c +++ b/drivers/gpio/gpiolib-shared.c @@ -399,7 +399,8 @@ int gpio_shared_add_proxy_lookup(struct device *consumer, unsigned long lflags) lookup->table[0] = GPIO_LOOKUP(no_free_ptr(key), 0, ref->con_id, lflags); - gpiod_add_lookup_table(no_free_ptr(lookup)); + ref->lookup = no_free_ptr(lookup); + gpiod_add_lookup_table(ref->lookup); return 0; } -- 2.47.3