gpio fixes for v6.18-rc7

- fix a use-after-free bug in GPIO character device code
 - update MAINTAINERS
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmkgdpIACgkQBZ0uy/82
 hMMt3Q/9E7I9oc89DFy9yZ6YXM8k2EpiIWvfygTMdVEx91i16L2591XFlrc6oQjQ
 c7Aaw6CWDVe20VlrWNMYxUQH2TUmROeQr3DJol8DUBRshLeVOEpWU6G0hvdFSucl
 lrDCS2ZkhNUswf0PLT+787OvdUhIvXGbvZv+Rcd5N+P7wxUwZkMStArl7PaAHVKt
 pNlUE6R0BtwPDWhi0wgag/RAmGo8TEdBcSinak9Ph9rdQg3GSPA1AsssFPqd1a13
 j2MdcWJQAEUKm6ecEcBSFeBR62LhhgIEo7iybHAtLml/qiGzz5sAj3gOBG4filLi
 YLhTLxKOiGzkpg+MqYioj42JCpCobEhIkPV+/W9jmZePFH2pyKEdHnI4dF0xcp/8
 +1WQo6xaZtTwADkyG3d0ardJdgZ0fc4AxQcSck29O+1NG0hd1Z+dL1cffdyJ8fxi
 OHucAlO/P/k7/T83eSZhRZaxdTWXCieWEJ1VzgwOsu/DnNvIcwhbyKGeFuS7z3Xj
 Gs1AFfh6GpFkK6ueZDz0ipBvtHqQTdzu1IwvosWMhmmPz/QdcxOywNK+UArvt6lg
 P5Tj6Wes0/ymZTKiPHicSx8UaqC8MliMKpJAWybePox6KieirXiht+a/qJvEXsbm
 ekPXH3RwsHNBlzB+dP+fa3aJWvd0F/2YVnug4T6a/QEVuNvJx7U=
 =nTA4
 -----END PGP SIGNATURE-----

Merge tag 'gpio-fixes-for-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull gpio fixes from Bartosz Golaszewski:

 - fix a use-after-free bug in GPIO character device code

 - update MAINTAINERS

* tag 'gpio-fixes-for-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  MAINTAINERS: update my email address
  gpio: cdev: make sure the cdev fd is still active before emitting events
This commit is contained in:
Linus Torvalds 2025-11-21 10:43:58 -08:00
commit 2c26574cc4
2 changed files with 15 additions and 10 deletions

View File

@ -3926,7 +3926,7 @@ F: crypto/async_tx/
F: include/linux/async_tx.h
AT24 EEPROM DRIVER
M: Bartosz Golaszewski <brgl@bgdev.pl>
M: Bartosz Golaszewski <brgl@kernel.org>
L: linux-i2c@vger.kernel.org
S: Maintained
T: git git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux.git
@ -10678,7 +10678,7 @@ F: tools/gpio/gpio-sloppy-logic-analyzer.sh
GPIO SUBSYSTEM
M: Linus Walleij <linus.walleij@linaro.org>
M: Bartosz Golaszewski <brgl@bgdev.pl>
M: Bartosz Golaszewski <brgl@kernel.org>
L: linux-gpio@vger.kernel.org
S: Maintained
T: git git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux.git
@ -10695,7 +10695,7 @@ K: GPIOD_FLAGS_BIT_NONEXCLUSIVE
K: devm_gpiod_unhinge
GPIO UAPI
M: Bartosz Golaszewski <brgl@bgdev.pl>
M: Bartosz Golaszewski <brgl@kernel.org>
R: Kent Gibson <warthog618@gmail.com>
L: linux-gpio@vger.kernel.org
S: Maintained
@ -15309,7 +15309,7 @@ F: drivers/pwm/pwm-max7360.c
F: include/linux/mfd/max7360.h
MAXIM MAX77650 PMIC MFD DRIVER
M: Bartosz Golaszewski <brgl@bgdev.pl>
M: Bartosz Golaszewski <brgl@kernel.org>
L: linux-kernel@vger.kernel.org
S: Maintained
F: Documentation/devicetree/bindings/*/*max77650.yaml
@ -19903,7 +19903,7 @@ F: drivers/pci/p2pdma.c
F: include/linux/pci-p2pdma.h
PCI POWER CONTROL
M: Bartosz Golaszewski <brgl@bgdev.pl>
M: Bartosz Golaszewski <brgl@kernel.org>
L: linux-pci@vger.kernel.org
S: Maintained
T: git git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci.git
@ -20500,7 +20500,7 @@ F: include/linux/powercap.h
F: kernel/configs/nopm.config
POWER SEQUENCING
M: Bartosz Golaszewski <brgl@bgdev.pl>
M: Bartosz Golaszewski <brgl@kernel.org>
L: linux-pm@vger.kernel.org
S: Maintained
T: git git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux.git
@ -21303,7 +21303,7 @@ F: Documentation/tee/qtee.rst
F: drivers/tee/qcomtee/
QUALCOMM TRUST ZONE MEMORY ALLOCATOR
M: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
M: Bartosz Golaszewski <brgl@kernel.org>
L: linux-arm-msm@vger.kernel.org
S: Maintained
F: drivers/firmware/qcom/qcom_tzmem.c
@ -25671,7 +25671,7 @@ F: Documentation/devicetree/bindings/crypto/ti,am62l-dthev2.yaml
F: drivers/crypto/ti/
TI DAVINCI MACHINE SUPPORT
M: Bartosz Golaszewski <brgl@bgdev.pl>
M: Bartosz Golaszewski <brgl@kernel.org>
L: linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
S: Maintained
T: git git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux.git

View File

@ -2548,10 +2548,17 @@ static int lineinfo_changed_notify(struct notifier_block *nb,
container_of(nb, struct gpio_chardev_data, lineinfo_changed_nb);
struct lineinfo_changed_ctx *ctx;
struct gpio_desc *desc = data;
struct file *fp;
if (!test_bit(gpio_chip_hwgpio(desc), cdev->watched_lines))
return NOTIFY_DONE;
/* Keep the file descriptor alive for the duration of the notification. */
fp = get_file_active(&cdev->fp);
if (!fp)
/* Chardev file descriptor was or is being released. */
return NOTIFY_DONE;
/*
* If this is called from atomic context (for instance: with a spinlock
* taken by the atomic notifier chain), any sleeping calls must be done
@ -2575,8 +2582,6 @@ static int lineinfo_changed_notify(struct notifier_block *nb,
/* Keep the GPIO device alive until we emit the event. */
ctx->gdev = gpio_device_get(desc->gdev);
ctx->cdev = cdev;
/* Keep the file descriptor alive too. */
get_file(ctx->cdev->fp);
INIT_WORK(&ctx->work, lineinfo_changed_func);
queue_work(ctx->gdev->line_state_wq, &ctx->work);