gpio: sysfs: fix use-after-free in error path
authorAntonio Quartulli <antonio@mandelbit.com>
Sun, 22 Jun 2025 22:02:21 +0000 (00:02 +0200)
committerBartosz Golaszewski <bartosz.golaszewski@linaro.org>
Mon, 23 Jun 2025 07:14:15 +0000 (09:14 +0200)
commite6bb78570f7d531622ec572ef9ddbe6e66ff16ce
treec70dbd8661a418a770d495a12d720ab35f125030
parentfd19792851db77e74cff4e2dc772d25a83cdc34d
gpio: sysfs: fix use-after-free in error path

When invoking device_create_with_groups(), its return value is stored
in `data->cdev_base`. However, in case of faiure, `data` is first freed
and then derefernced in order to return `data->cdev_base`.

Fix the use-after-free by extracting the error code before free'ing
`data`.

Fixes: fd19792851db ("gpio: sysfs: remove the mockdev pointer from struct gpio_device")
Addresses-Coverity-ID: 1644512 ("Memory - illegal accesses  (USE_AFTER_FREE)")
Signed-off-by: Antonio Quartulli <antonio@mandelbit.com>
Link: https://lore.kernel.org/r/20250622220221.28025-1-antonio@mandelbit.com
[Bartosz: added Fixes: tag, tweaked commit message]
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
drivers/gpio/gpiolib-sysfs.c