Re: [PATCH] gpio: Avoid NULL dereference in linehandle_create()

[Kent Gibson]

On Fri, Feb 13, 2026 at 09:29:31AM -0800, Douglas Anderson wrote:
> In linehandle_create(), there is a statement like this:
>   retain_and_null_ptr(lh);
> 
> Soon after, there is a debug printout that dereferences "lh", which
> will crash things.
> 
> Avoid the crash by reading value needed by the printout before making
> "lh" NULL.
> 
> Fixes: da7e394bf58f ("gpio: convert linehandle_create() to FD_PREPARE()")
> Signed-off-by: Douglas Anderson <dianders@xxxxxxxxxxxx>
> ---
> 
>  drivers/gpio/gpiolib-cdev.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c
> index 2adc3c070908..13ab6a5ebb76 100644
> --- a/drivers/gpio/gpiolib-cdev.c
> +++ b/drivers/gpio/gpiolib-cdev.c
> @@ -304,6 +304,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
>  {
>  	struct gpiohandle_request handlereq;
>  	struct linehandle_state *lh __free(linehandle_free) = NULL;
> +	u32 num_descs;
>  	int i, ret;
>  	u32 lflags;
>  
> @@ -379,6 +380,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
>  				      lh, O_RDONLY | O_CLOEXEC));
>  	if (fdf.err)
>  		return fdf.err;
> +	num_descs = lh->num_descs;
>  	retain_and_null_ptr(lh);
>  
>  	handlereq.fd = fd_prepare_fd(fdf);
> @@ -388,7 +390,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
>  	fd_publish(fdf);
>  
>  	dev_dbg(&gdev->dev, "registered chardev handle for %d lines\n",
> -		lh->num_descs);
> +		num_descs);
>  

Use handlereq.lines rather than creating another local shadow.

Cheers,
Kent.