[PATCH] gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths

[PATCH] gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths

[Kent Gibson]

A drive-by review by Sashiko reports that, after a failed call to
gpiochip_set_multiple(), gpiod_set_array_value() returns abruptly,
bypassing the freeing of possibly alloced bitmaps, potentially leaking
memory. It is an unlikely error path, but is possible.

Defer the return code check until after the bitmap_free() block.

Fixes: 9b407312755f ("gpiolib: rework the wrapper around gpio_chip::set_multiple()")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/linux-gpio/sashiko-outbox-168233@kernel.org/
Signed-off-by: Kent Gibson <warthog618@gmail.com>
---
 drivers/gpio/gpiolib.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 0586fc1f9564..921e411314cd 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -3968,16 +3968,17 @@ int gpiod_set_array_value_complex(bool raw, bool can_sleep,
 		} while ((i < array_size) &&
 			 gpio_device_chip_cmp(desc_array[i]->gdev, guard.gc));
 		/* push collected bits to outputs */
-		if (count != 0) {
+		ret = 0;
+		if (count != 0)
 			ret = gpiochip_set_multiple(guard.gc, mask, bits);
-			if (ret)
-				return ret;
-		}
 
 		if (mask != fastpath_mask)
 			bitmap_free(mask);
 		if (bits != fastpath_bits)
 			bitmap_free(bits);
+
+		if (ret)
+			return ret;
 	}
 	return 0;
 }
-- 
2.56.0

Re: [PATCH] gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths

[Bartosz Golaszewski]

On Thu, 15 Oct 2026 10:57:49 +0800, Kent Gibson wrote:
> A drive-by review by Sashiko reports that, after a failed call to
> gpiochip_set_multiple(), gpiod_set_array_value() returns abruptly,
> bypassing the freeing of possibly alloced bitmaps, potentially leaking
> memory. It is an unlikely error path, but is possible.
> 
> Defer the return code check until after the bitmap_free() block.
> 
> [...]

Applied, thanks!

[1/1] gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths
      https://git.kernel.org/brgl/c/c28846ca1ac6134881114d272314623c8433e372

Best regards,
-- 
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>