gpiolib: Fix use after free in gpiochip_add_pin_range

PATCH In review Axel Lin 2 participants 2 messages Nov 21, 2012 GPIO

lore

Share & tools

lore

Axel Lin

author

2012-11-21 06:34 UTC #0 lore raw

PATCH 1/1 gpiolib: Fix use after free in gpiochip_add_pin_range

This is introduced by commit 9ab6e988 "gpiolib: return any error code from range creation".

Signed-off-by Axel Lin <[email protected]>

---
This patch is against LinusW's linux-pinctrl tree, for-next branch. Axel

 drivers/gpio/gpiolib.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

drivers/gpio/gpiolib.c +3 -1

index 317ff04..8370214 100644
@@ -1201,6 +1201,7 @@ int gpiochip_add_pin_range(struct gpio_chip *chip, const char *pinctl_name,
 			   unsigned int npins)
 {
 	struct gpio_pin_range *pin_range;
+	int ret;
 
 	pin_range = kzalloc(sizeof(*pin_range), GFP_KERNEL);
 	if (!pin_range) {

@@ -1219,10 +1220,11 @@ int gpiochip_add_pin_range(struct gpio_chip *chip, const char *pinctl_name,
 	pin_range->pctldev = pinctrl_find_and_add_gpio_range(pinctl_name,
 			&pin_range->range);
 	if (IS_ERR(pin_range->pctldev)) {
+		ret = PTR_ERR(pin_range->pctldev);
 		pr_err("%s: GPIO chip: could not create pin range\n",
 		       chip->label);
 		kfree(pin_range);
-		return PTR_ERR(pin_range->pctldev);
+		return ret;
 	}
 	pr_debug("%s: GPIO chip: created GPIO range %d->%d ==> PIN %d->%d\n",
 		 chip->label, offset, offset + npins - 1,

Signature · 1 line

1.7.9.5

Linus Walleij

2012-11-21 08:00 UTC #1 lore raw

Quoted 7 lines · Axel Lin

This is introduced by commit 9ab6e988 "gpiolib: return any error code from range creation".
Signed-off-by Axel Lin <[email protected]>
---
This patch is against LinusW's linux-pinctrl tree, for-next branch. Axel

Oops thanks a lot for catching this Axel!

Yours,
Linus Walleij