Files
linux/drivers/gpio
Bartosz Golaszewski 30c073cab9 gpio: aggregator: fix a potential use-after-free
On error we free aggr->lookups->dev_id before removing the entry from
the lookup table. If a concurrent thread calls gpiod_find() before we
remove the entry, it could iterate over the list and call
gpiod_match_lookup_table() which unconditionally dereferences dev_id
when calling strcmp(). Reverse the order of cleanup.

Fixes: 86f162e73d ("gpio: aggregator: introduce basic configfs interface")
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260520084911.27938-1-bartosz.golaszewski@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-05-21 12:00:42 +02:00
..
2026-03-31 14:13:14 +01:00
2026-01-13 15:17:35 +01:00
2025-11-25 14:10:07 +01:00
2025-11-25 14:10:06 +01:00
2025-11-25 14:10:07 +01:00
2026-03-16 09:51:05 +01:00
2026-03-16 09:51:05 +01:00
2026-03-16 09:51:05 +01:00
2026-04-07 12:32:28 +02:00