[PATCH] gpio: Avoid NULL dereference in linehandle_create()

[Douglas Anderson]

In linehandle_create(), there is a statement like this:
  retain_and_null_ptr(lh);

Soon after, there is a debug printout that dereferences "lh", which
will crash things.

Avoid the crash by reading value needed by the printout before making
"lh" NULL.

Fixes: da7e394bf58f ("gpio: convert linehandle_create() to FD_PREPARE()")
Signed-off-by: Douglas Anderson <dianders@xxxxxxxxxxxx>
---

 drivers/gpio/gpiolib-cdev.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c
index 2adc3c070908..13ab6a5ebb76 100644
--- a/drivers/gpio/gpiolib-cdev.c
+++ b/drivers/gpio/gpiolib-cdev.c
@@ -304,6 +304,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
 {
 	struct gpiohandle_request handlereq;
 	struct linehandle_state *lh __free(linehandle_free) = NULL;
+	u32 num_descs;
 	int i, ret;
 	u32 lflags;
 
@@ -379,6 +380,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
 				      lh, O_RDONLY | O_CLOEXEC));
 	if (fdf.err)
 		return fdf.err;
+	num_descs = lh->num_descs;
 	retain_and_null_ptr(lh);
 
 	handlereq.fd = fd_prepare_fd(fdf);
@@ -388,7 +390,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
 	fd_publish(fdf);
 
 	dev_dbg(&gdev->dev, "registered chardev handle for %d lines\n",
-		lh->num_descs);
+		num_descs);
 
 	return 0;
 }
-- 
2.53.0.273.g2a3d683680-goog