linux-kernel - [PATCH 04/24] gpio: fix dangling pointers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 20 Mar 2010 15:12:45 +0100
From:	Wolfram Sang <w.sang@...gutronix.de>
To:	kernel-janitors@...r.kernel.org
Cc:	linux-i2c@...r.kernel.org, linux-kernel@...r.kernel.org,
	Wolfram Sang <w.sang@...gutronix.de>
Subject: [PATCH 04/24] gpio: fix dangling pointers

Fix I2C-drivers which missed setting clientdata to NULL before freeing the
structure it points to. Also fix drivers which do this _after_ the structure
was freed already.

Signed-off-by: Wolfram Sang <w.sang@...gutronix.de>
---

Found using coccinelle, then reviewed. Full patchset is available via
kernel-janitors, linux-i2c, and LKML.
---
 drivers/gpio/adp5588-gpio.c |    1 +
 drivers/gpio/max732x.c      |    1 +
 drivers/gpio/pca953x.c      |    1 +
 drivers/gpio/pcf857x.c      |    7 ++++---
 4 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/gpio/adp5588-gpio.c b/drivers/gpio/adp5588-gpio.c
index afc097a..c0cb5c1 100644
--- a/drivers/gpio/adp5588-gpio.c
+++ b/drivers/gpio/adp5588-gpio.c
@@ -227,6 +227,7 @@ static int __devexit adp5588_gpio_remove(struct i2c_client *client)
 		return ret;
 	}
 
+	i2c_set_clientdata(client, NULL);
 	kfree(dev);
 	return 0;
 }
diff --git a/drivers/gpio/max732x.c b/drivers/gpio/max732x.c
index f786824..85fe675 100644
--- a/drivers/gpio/max732x.c
+++ b/drivers/gpio/max732x.c
@@ -356,6 +356,7 @@ static int __devexit max732x_remove(struct i2c_client *client)
 	if (chip->client_dummy)
 		i2c_unregister_device(chip->client_dummy);
 
+	i2c_set_clientdata(client, NULL);
 	kfree(chip);
 	return 0;
 }
diff --git a/drivers/gpio/pca953x.c b/drivers/gpio/pca953x.c
index ab5daab..05242dc 100644
--- a/drivers/gpio/pca953x.c
+++ b/drivers/gpio/pca953x.c
@@ -571,6 +571,7 @@ static int pca953x_remove(struct i2c_client *client)
 
 	pca953x_irq_teardown(chip);
 	kfree(chip->dyn_pdata);
+	i2c_set_clientdata(client, NULL);
 	kfree(chip);
 	return 0;
 }
diff --git a/drivers/gpio/pcf857x.c b/drivers/gpio/pcf857x.c
index 29f19ce..c2aed8a 100644
--- a/drivers/gpio/pcf857x.c
+++ b/drivers/gpio/pcf857x.c
@@ -259,9 +259,7 @@ static int pcf857x_probe(struct i2c_client *client,
 		goto fail;
 
 	gpio->chip.label = client->name;
-
 	gpio->client = client;
-	i2c_set_clientdata(client, gpio);
 
 	/* NOTE:  these chips have strange "quasi-bidirectional" I/O pins.
 	 * We can't actually know whether a pin is configured (a) as output
@@ -307,6 +305,7 @@ static int pcf857x_probe(struct i2c_client *client,
 			dev_warn(&client->dev, "setup --> %d\n", status);
 	}
 
+	i2c_set_clientdata(client, gpio);
 	return 0;
 
 fail:
@@ -334,8 +333,10 @@ static int pcf857x_remove(struct i2c_client *client)
 	}
 
 	status = gpiochip_remove(&gpio->chip);
-	if (status == 0)
+	if (status == 0) {
+		i2c_set_clientdata(client, NULL);
 		kfree(gpio);
+	}
 	else
 		dev_err(&client->dev, "%s --> %d\n", "remove", status);
 	return status;
-- 
1.7.0

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/