[PATCH 01/10] regulator: irq_helpers: Clear caller handle in regulator_irq_helper_cancel()

[Lee Jones <lee@kernel.org>]

regulator_irq_helper_cancel() is documented as clearing the caller's
handle pointer upon return, and takes a void **handle parameter for
that purpose.  Instead, it assigns NULL to the local pointer h before
returning, leaving the caller with a dangling pointer to freed memory.

Dereference handle to clear the caller's pointer as intended.

Fixes: 7111c6d1b31b ("regulator: IRQ based event/error notification helpers")
Closes: https://sashiko.dev/#/bug/linux-5c3d3b21-3823-4654-bf5d-85407c5fd05f
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/regulator/irq_helpers.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/regulator/irq_helpers.c b/drivers/regulator/irq_helpers.c
index cdbd170d2b15..7b25eae667e3 100644
--- a/drivers/regulator/irq_helpers.c
+++ b/drivers/regulator/irq_helpers.c
@@ -403,7 +403,7 @@ void regulator_irq_helper_cancel(void **handle)
 				destroy_workqueue(h->wq);
 		}
 
-		h = NULL;
+		*handle = NULL;
 	}
 }
 EXPORT_SYMBOL_GPL(regulator_irq_helper_cancel);
-- 
2.56.0.385.gac671c819a-goog