This is a note to let you know that I've just added the patch titled
gpiolib: Fix potential NULL pointer dereference in gpiod_get_label()
to the 6.11-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
gpiolib-fix-potential-null-pointer-dereference-in-gp.patch
and it can be found in the queue-6.11 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit 151ece6029a1e607a4c2a338cd6bf0f4a084b183
Author: Lad Prabhakar <prabhakar.mahadev-lad.rj@xxxxxxxxxxxxxx>
Date: Thu Oct 3 14:13:51 2024 +0100
gpiolib: Fix potential NULL pointer dereference in gpiod_get_label()
[ Upstream commit 7b99b5ab885993bff010ebcd93be5e511c56e28a ]
In `gpiod_get_label()`, it is possible that `srcu_dereference_check()` may
return a NULL pointer, leading to a scenario where `label->str` is accessed
without verifying if `label` itself is NULL.
This patch adds a proper NULL check for `label` before accessing
`label->str`. The check for `label->str != NULL` is removed because
`label->str` can never be NULL if `label` is not NULL.
This fixes the issue where the label name was being printed as `(efault)`
when dumping the sysfs GPIO file when `label == NULL`.
Fixes: 5a646e03e956 ("gpiolib: Return label, if set, for IRQ only line")
Fixes: a86d27693066 ("gpiolib: fix the speed of descriptor label setting with SRCU")
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@xxxxxxxxxxxxxx>
Link: https://lore.kernel.org/r/20241003131351.472015-1-prabhakar.mahadev-lad.rj@xxxxxxxxxxxxxx
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@xxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 3a9668cc100df..148bcfbf98e02 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -115,12 +115,12 @@ const char *gpiod_get_label(struct gpio_desc *desc)
srcu_read_lock_held(&desc->gdev->desc_srcu));
if (test_bit(FLAG_USED_AS_IRQ, &flags))
- return label->str ?: "interrupt";
+ return label ? label->str : "interrupt";
if (!test_bit(FLAG_REQUESTED, &flags))
return NULL;
- return label->str;
+ return label ? label->str : NULL;
}
static void desc_free_label(struct rcu_head *rh)
