If anon_inode_getfd() fails then "i" is set to GPIOHANDLES_MAX. It
means that we will read beyond the end of the array and dereference an
invalid pointer.
Fixes: d7c51b47ac11 ('gpio: userspace ABI for reading/writing GPIO lines')
Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 8b3db59..8578b7f 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -495,6 +495,8 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
return 0;
out_free_descs:
+ if (i == GPIOHANDLES_MAX)
+ i--;
for (; i >= 0; i--)
gpiod_free(lh->descs[i]);
kfree(lh->label);
--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
