Commit b4d4b1f0 authored by Axel Lin's avatar Axel Lin Committed by Linus Walleij
Browse files

gpiolib: Fix use after free in gpiochip_add_pin_range 



This is introduced by commit 9ab6e988
"gpiolib: return any error code from range creation".

Signed-off-by: default avatarAxel Lin <axel.lin@ingics.com>
Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
parent 316511c0

drivers/gpio/gpiolib.c

+3 −1
Original line number Diff line number Diff line
@@ -1201,6 +1201,7 @@ int gpiochip_add_pin_range(struct gpio_chip *chip, const char *pinctl_name, 
			   unsigned int npins)

{

	struct gpio_pin_range *pin_range;

	int ret;



	pin_range = kzalloc(sizeof(*pin_range), GFP_KERNEL);

	if (!pin_range) {
@@ -1219,10 +1220,11 @@ int gpiochip_add_pin_range(struct gpio_chip *chip, const char *pinctl_name, 
	pin_range->pctldev = pinctrl_find_and_add_gpio_range(pinctl_name,

			&pin_range->range);

	if (IS_ERR(pin_range->pctldev)) {

		ret = PTR_ERR(pin_range->pctldev);

		pr_err("%s: GPIO chip: could not create pin range\n",

		       chip->label);

		kfree(pin_range);

		return PTR_ERR(pin_range->pctldev);

		return ret;

	}

	pr_debug("GPIO chip %s: created GPIO range %d->%d ==> %s PIN %d->%d\n",

		 chip->label, gpio_offset, gpio_offset + npins - 1,