]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
gpio: aggregator: fix a potential use-after-free
authorBartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Wed, 20 May 2026 08:49:11 +0000 (10:49 +0200)
committerBartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Thu, 21 May 2026 10:00:42 +0000 (12:00 +0200)
commit30c073cab97afb31901f94de9605177b6b84367e
tree631ef6d2310e9ea64f9eba63552ead2d342e21a1
parent3e6ccd790ed69bedd3d9626d01dd35cf9821c121
gpio: aggregator: fix a potential use-after-free

On error we free aggr->lookups->dev_id before removing the entry from
the lookup table. If a concurrent thread calls gpiod_find() before we
remove the entry, it could iterate over the list and call
gpiod_match_lookup_table() which unconditionally dereferences dev_id
when calling strcmp(). Reverse the order of cleanup.

Fixes: 86f162e73d2d ("gpio: aggregator: introduce basic configfs interface")
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260520084911.27938-1-bartosz.golaszewski@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
drivers/gpio/gpio-aggregator.c