gpioib: do not free unrequested descriptors (ab3dbcf7) · Commits · 戴 / test

If the main loop in linehandle_create() encounters an error, it unwinds completely by freeing all previously requested GPIO descriptors. However, if the error occurs in the beginning of the loop before that GPIO is requested, then the exit code attempts to free a null descriptor. If extrachecks is enabled, gpiod_free() triggers a WARN_ON. Instead, keep a separate count of legitimate GPIOs so that only those are freed. Cc: stable@vger.kernel.org Fixes: ("gpio: userspace ABI for reading/writing GPIO lines") Reviewed-by:

Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by:

Timur Tabi <timur@codeaurora.org> Signed-off-by:

Linus Walleij <linus.walleij@linaro.org>

drivers/gpio/gpiolib.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -497,7 +497,7 @@ static int linehandle_create(struct gpio_device gdev, void __user ip)
		struct gpiohandle_request handlereq;
		struct linehandle_state *lh;
		struct file *file;
		int fd, i, ret;
		int fd, i, count = 0, ret;
		u32 lflags;

		if (copy_from_user(&handlereq, ip, sizeof(handlereq)))
		@@ -558,6 +558,7 @@ static int linehandle_create(struct gpio_device gdev, void __user ip)
		if (ret)
		goto out_free_descs;
		lh->descs[i] = desc;
		count = i;

		if (lflags & GPIOHANDLE_REQUEST_ACTIVE_LOW)
		set_bit(FLAG_ACTIVE_LOW, &desc->flags);
		@@ -628,7 +629,7 @@ static int linehandle_create(struct gpio_device gdev, void __user ip)
		out_put_unused_fd:
		put_unused_fd(fd);
		out_free_descs:
		for (; i >= 0; i--)
		for (i = 0; i < count; i++)
		gpiod_free(lh->descs[i]);
		kfree(lh->label);
		out_free_lh:

Admin message