@@ -315,13 +315,19 @@ static long linehandle_ioctl_compat(struct file *file, unsigned int cmd,
static void linehandle_free(struct linehandle_state *lh)
{
+ struct gpio_device *gdev = lh->gdev;
int i;
- for (i = 0; i < lh->num_descs; i++)
- if (lh->descs[i])
- gpiod_free(lh->descs[i]);
+ for (i = 0; i < lh->num_descs; i++) {
+ if (lh->descs[i]) {
+ down_write(&gdev->sem);
+ if (gdev->chip)
+ gpiod_free(lh->descs[i]);
+ up_write(&gdev->sem);
+ }
+ }
kfree(lh->label);
- gpio_device_put(lh->gdev);
+ gpio_device_put(gdev);
kfree(lh);
}
@@ -1565,17 +1571,21 @@ static ssize_t linereq_read(struct file *file, char __user *buf,
static void linereq_free(struct linereq *lr)
{
+ struct gpio_device *gdev = lr->gdev;
unsigned int i;
for (i = 0; i < lr->num_lines; i++) {
if (lr->lines[i].desc) {
edge_detector_stop(&lr->lines[i]);
- gpiod_free(lr->lines[i].desc);
+ down_write(&gdev->sem);
+ if (gdev->chip)
+ gpiod_free(lr->lines[i].desc);
+ up_write(&gdev->sem);
}
}
kfifo_free(&lr->events);
kfree(lr->label);
- gpio_device_put(lr->gdev);
+ gpio_device_put(gdev);
kfree(lr);
}
When a GPIO device is forcefully unregistered, we are left with an inactive object. If user-space kept an open file descriptor to a line request associated with such a structure, upon closing it, we'll see the kernel crash due to freeing unexistent GPIO descriptors. Fix it by checking if chip is still alive before calling gpiod_free() in release callbacks for both v2 and v1 ABI. Fixes: 3c0d9c635ae2 ("gpiolib: cdev: support GPIO_V2_GET_LINE_IOCTL and GPIO_V2_LINE_GET_VALUES_IOCTL") Reported-by: Kent Gibson <warthog618@gmail.com> Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl> --- drivers/gpio/gpiolib-cdev.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-)