[PATCH] gpiolib: Fix shared GPIO memory leaks

[PATCH] gpiolib: Fix shared GPIO memory leaks

[Daniel J Blueman]

On a Snapdragon X1 Elite laptop (Lenovo Yoga Slim 7x), kmemleak reports
three sets of:

unreferenced object 0xffff00080187f400 (size 1024):
  comm "swapper/0", pid 1, jiffies 4294667327
  hex dump (first 32 bytes):
    58 bd 70 01 08 00 ff ff 58 bd 70 01 08 00 ff ff  X.p.....X.p.....
    00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00  ................
  backtrace (crc 1665d1f8):
    kmemleak_alloc+0xf4/0x12c
    __kmalloc_cache_noprof+0x370/0x49c
    gpio_shared_make_ref+0x70/0x16c
    gpio_shared_of_traverse+0x4e8/0x5f4
    gpio_shared_of_traverse+0x200/0x5f4
    gpio_shared_of_traverse+0x200/0x5f4
    gpio_shared_of_traverse+0x200/0x5f4
    gpio_shared_of_traverse+0x200/0x5f4
    gpio_shared_init+0x34/0x1c4
    do_one_initcall+0x50/0x280
    kernel_init_freeable+0x290/0x33c
    kernel_init+0x28/0x14c
    ret_from_fork+0x10/0x20

unreferenced object 0xffff00080170c140 (size 8):
  comm "swapper/0", pid 1, jiffies 4294667327
  hex dump (first 8 bytes):
    72 65 73 65 74 00 00 00                          reset...
  backtrace (crc fc24536):
    kmemleak_alloc+0xf4/0x12c
    __kmalloc_node_track_caller_noprof+0x3c4/0x584
    kstrdup+0x4c/0xcc
    gpio_shared_make_ref+0x8c/0x16c
    gpio_shared_of_traverse+0x4e8/0x5f4
    gpio_shared_of_traverse+0x200/0x5f4
    gpio_shared_of_traverse+0x200/0x5f4
    gpio_shared_of_traverse+0x200/0x5f4
    gpio_shared_of_traverse+0x200/0x5f4
    gpio_shared_init+0x34/0x1c4
    do_one_initcall+0x50/0x280
    kernel_init_freeable+0x290/0x33c
    kernel_init+0x28/0x14c
    ret_from_fork+0x10/0x20

Fix this by decrementing the reference count of each list entry rather than
only the first.

Fix verified on the same laptop.

Fixes: a060b8c511abb gpiolib: implement low-level, shared GPIO support
Signed-off-by: Daniel J Blueman <daniel@quora.org>
---
 drivers/gpio/gpiolib-shared.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpio/gpiolib-shared.c b/drivers/gpio/gpiolib-shared.c
index 9e6544203439..e16f467b72e7 100644
--- a/drivers/gpio/gpiolib-shared.c
+++ b/drivers/gpio/gpiolib-shared.c
@@ -753,14 +753,14 @@ static bool gpio_shared_entry_is_really_shared(struct gpio_shared_entry *entry)
 static void gpio_shared_free_exclusive(void)
 {
 	struct gpio_shared_entry *entry, *epos;
+	struct gpio_shared_ref *ref, *rpos;
 
 	list_for_each_entry_safe(entry, epos, &gpio_shared_list, list) {
 		if (gpio_shared_entry_is_really_shared(entry))
 			continue;
 
-		gpio_shared_drop_ref(list_first_entry(&entry->refs,
-						      struct gpio_shared_ref,
-						      list));
+		list_for_each_entry_safe(ref, rpos, &entry->refs, list)
+			gpio_shared_drop_ref(ref);
 		gpio_shared_drop_entry(entry);
 	}
 }
-- 
2.51.0

Re: [PATCH] gpiolib: Fix shared GPIO memory leaks

[Bartosz Golaszewski]

On Fri, 20 Feb 2026 17:34:51 +0800, Daniel J Blueman wrote:
> On a Snapdragon X1 Elite laptop (Lenovo Yoga Slim 7x), kmemleak reports
> three sets of:
> 
> unreferenced object 0xffff00080187f400 (size 1024):
>   comm "swapper/0", pid 1, jiffies 4294667327
>   hex dump (first 32 bytes):
>     58 bd 70 01 08 00 ff ff 58 bd 70 01 08 00 ff ff  X.p.....X.p.....
>     00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00  ................
>   backtrace (crc 1665d1f8):
>     kmemleak_alloc+0xf4/0x12c
>     __kmalloc_cache_noprof+0x370/0x49c
>     gpio_shared_make_ref+0x70/0x16c
>     gpio_shared_of_traverse+0x4e8/0x5f4
>     gpio_shared_of_traverse+0x200/0x5f4
>     gpio_shared_of_traverse+0x200/0x5f4
>     gpio_shared_of_traverse+0x200/0x5f4
>     gpio_shared_of_traverse+0x200/0x5f4
>     gpio_shared_init+0x34/0x1c4
>     do_one_initcall+0x50/0x280
>     kernel_init_freeable+0x290/0x33c
>     kernel_init+0x28/0x14c
>     ret_from_fork+0x10/0x20
> 
> [...]

Applied, thanks!

[1/1] gpiolib: Fix shared GPIO memory leaks
      https://git.kernel.org/brgl/c/32e0a7ad9c841f46549ccac0f1cca347a40d8685

Best regards,
-- 
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>