Skip to contentSkip to conversation

gpiolib: fix invalid pointer access in debugfs

PATCH Applied Bartosz Golaszewski 2 participants 3 messages Nov 3, 2025 GPIO

lore
Share & tools
lore

Bartosz Golaszewski

author
#0 lore raw

PATCH v2 1/1 gpiolib: fix invalid pointer access in debugfs

From: Bartosz Golaszewski <[email protected]>

If the memory allocation in gpiolib_seq_start() fails, the s->private field remains uninitialized and is later dereferenced without checking in gpiolib_seq_stop(). Initialize s->private to NULL before calling kzalloc() and check it before dereferencing it.

Fixes e348544f7994 ("gpio: protect the list of GPIO devices with SRCU")
Reviewed-by Linus Walleij <[email protected]>
Signed-off-by Bartosz Golaszewski <[email protected]>

---
Changes in v2:
- Initialize priv right before checking it for NULL in gpiolib_seq_stop()

 drivers/gpio/gpiolib.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/gpio/gpiolib.c +7 -1
index a81981336b36d..3659acc600d96 100644
@@ -5303,6 +5303,8 @@ static void *gpiolib_seq_start(struct seq_file *s, loff_t *pos)
 	struct gpio_device *gdev;
 	loff_t index = *pos;
 
+	s->private = NULL;
+
 	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
 	if (!priv)
 		return NULL;

@@ -5336,7 +5338,11 @@ static void *gpiolib_seq_next(struct seq_file *s, void *v, loff_t *pos)
 
 static void gpiolib_seq_stop(struct seq_file *s, void *v)
 {
-	struct gpiolib_seq_priv *priv = s->private;
+	struct gpiolib_seq_priv *priv;
+
+	priv = s->private;
+	if (!priv)
+		return;
 
 	srcu_read_unlock(&gpio_devices_srcu, priv->idx);
 	kfree(priv);
Signature · 1 line
2.51.0
Reviewed-by on v2 1/1
#1 lore raw
Quoted 4 lines · Bartosz Golaszewski

If the memory allocation in gpiolib_seq_start() fails, the s->private field remains uninitialized and is later dereferenced without checking in gpiolib_seq_stop(). Initialize s->private to NULL before calling kzalloc() and check it before dereferencing it.

Reviewed-by Andy Shevchenko <[email protected]>
Signature · 2 lines
With Best Regards,
Andy Shevchenko
author Applied
#2 lore raw
In reply to Bartosz Golaszewski

From: Bartosz Golaszewski <[email protected]>

Quoted 6 lines · Bartosz Golaszewski

If the memory allocation in gpiolib_seq_start() fails, the s->private field remains uninitialized and is later dereferenced without checking in gpiolib_seq_stop(). Initialize s->private to NULL before calling kzalloc() and check it before dereferencing it.

Applied, thanks!

[1/1] gpiolib: fix invalid pointer access in debugfs

      https://git.kernel.org/brgl/linux/c/2f6115ad8864cf3f48598f26c74c7c8e5c391919

Best regards,

Signature · 1 line
Bartosz Golaszewski <[email protected]>