Re: linux-evl 7.2 OOB GPIO NULL dereference in lineevent_create

[Philippe Gerum <rpm@xenomai.org>]

Martínek Petr <petr.martinek@elvac.eu> writes:

> In lineevent_create le->oob_state is used after retain_and_null_ptr(le)
> which set le to NULL. Included patch adds oob_state variable
> to fix this. 
>
> Signed-off-by: Petr Martínek <petr.martinek@elvac.eu>
> ---
> diff -Naur a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c
> --- a/drivers/gpio/gpiolib-cdev.c	2026-09-23 08:39:20.000000000 +0200
> +++ b/drivers/gpio/gpiolib-cdev.c	2026-11-11 10:25:07.714465106 +0100
> @@ -2222,6 +2222,7 @@
>  {
>  	struct gpioevent_request eventreq;
>  	struct lineevent_state *le __free(lineevent_free) = NULL;
> +	struct lineevent_oob_state* oob_state;
>  	struct gpio_desc *desc;
>  	u32 offset;
>  	u32 lflags;
> @@ -2340,10 +2341,12 @@
>  				      O_RDONLY | O_CLOEXEC));
>  	if (fdf.err)
>  		return fdf.err;
> +		
> +	oob_state = &le->oob_state;
>  	retain_and_null_ptr(le);
>  
>  	if (oob_handling_requested(lflags)) {
> -		ret = evl_open_file(&le->oob_state.efile, fd_prepare_file(fdf));
> +		ret = evl_open_file(&oob_state->efile, fd_prepare_file(fdf));
>  		if (ret)
>  			return ret;
>  	}
> @@ -2351,7 +2354,7 @@
>  	eventreq.fd = fd_prepare_fd(fdf);
>  	if (copy_to_user(ip, &eventreq, sizeof(eventreq))) {
>  		if (oob_handling_requested(lflags))
> -			evl_release_file(&le->oob_state.efile);
> +			evl_release_file(&oob_state->efile);
>  		return -EFAULT;
>  	}
>  

Merged, thanks.

-- 
Philippe.