Re: [PATCH 01/10] regulator: irq_helpers: Clear caller handle in regulator_irq_helper_cancel()

[Matti Vaittinen]

On 04/11/2026 20:20, Lee Jones wrote:
> regulator_irq_helper_cancel() is documented as clearing the caller's
> handle pointer upon return, and takes a void **handle parameter for
> that purpose.  Instead, it assigns NULL to the local pointer h before
> returning, leaving the caller with a dangling pointer to freed memory.
>
> Dereference handle to clear the caller's pointer as intended.
>
> Fixes: 7111c6d1b31b ("regulator: IRQ based event/error notification helpers")
> Closes: https://sashiko.dev/#/bug/linux-5c3d3b21-3823-4654-bf5d-85407c5fd05f
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Lee Jones <lee@xxxxxxxxxx>

Good catch! Thanks a lot :)

Reviewed-by: Matti Vaittinen <mazziesaccount@xxxxxxxxx>

> ---
>   drivers/regulator/irq_helpers.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/regulator/irq_helpers.c b/drivers/regulator/irq_helpers.c
> index cdbd170d2b15..7b25eae667e3 100644
> --- a/drivers/regulator/irq_helpers.c
> +++ b/drivers/regulator/irq_helpers.c
> @@ -403,7 +403,7 @@ void regulator_irq_helper_cancel(void **handle)
>   				destroy_workqueue(h->wq);
>   		}
>   
> -		h = NULL;
> +		*handle = NULL;
>   	}
>   }
>   EXPORT_SYMBOL_GPL(regulator_irq_helper_cancel);


--
Matti Vaittinen
Linux kernel developer at ROHM Semiconductors
Oulu Finland

~~ When things go utterly wrong vim users can always type :help! ~~