diff options
| author | Antonio Quartulli <antonio@mandelbit.com> | 2025-06-23 00:02:21 +0200 |
|---|---|---|
| committer | Bartosz Golaszewski <bartosz.golaszewski@linaro.org> | 2025-06-23 09:14:15 +0200 |
| commit | e6bb78570f7d531622ec572ef9ddbe6e66ff16ce (patch) | |
| tree | c70dbd8661a418a770d495a12d720ab35f125030 /drivers/gpio/gpiolib-sysfs.c | |
| parent | fd19792851db77e74cff4e2dc772d25a83cdc34d (diff) | |
gpio: sysfs: fix use-after-free in error path
When invoking device_create_with_groups(), its return value is stored
in `data->cdev_base`. However, in case of faiure, `data` is first freed
and then derefernced in order to return `data->cdev_base`.
Fix the use-after-free by extracting the error code before free'ing
`data`.
Fixes: fd19792851db ("gpio: sysfs: remove the mockdev pointer from struct gpio_device")
Addresses-Coverity-ID: 1644512 ("Memory - illegal accesses (USE_AFTER_FREE)")
Signed-off-by: Antonio Quartulli <antonio@mandelbit.com>
Link: https://lore.kernel.org/r/20250622220221.28025-1-antonio@mandelbit.com
[Bartosz: added Fixes: tag, tweaked commit message]
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Diffstat (limited to 'drivers/gpio/gpiolib-sysfs.c')
| -rw-r--r-- | drivers/gpio/gpiolib-sysfs.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/gpio/gpiolib-sysfs.c b/drivers/gpio/gpiolib-sysfs.c index 956411fc467a..c4c21e25c682 100644 --- a/drivers/gpio/gpiolib-sysfs.c +++ b/drivers/gpio/gpiolib-sysfs.c @@ -741,6 +741,7 @@ int gpiochip_sysfs_register(struct gpio_device *gdev) struct gpiodev_data *data; struct gpio_chip *chip; struct device *parent; + int err; /* * Many systems add gpio chips for SOC support very early, @@ -781,8 +782,9 @@ int gpiochip_sysfs_register(struct gpio_device *gdev) GPIOCHIP_NAME "%d", chip->base); if (IS_ERR(data->cdev_base)) { + err = PTR_ERR(data->cdev_base); kfree(data); - return PTR_ERR(data->cdev_base); + return err; } return 0; |