[PATCH] gpiolib: Free chip resources when allocating the label fails

[PATCH] gpiolib: Free chip resources when allocating the label fails

[Baek Kyu, Kim]

If desc_set_label() fails after the chip's request callback succeeds,
gpiod_request_commit() clears GPIOD_FLAG_REQUESTED without calling the
free callback. The caller receives an error and has no GPIO to release,
leaving resources acquired by the request callback held.

Call the chip's free callback, if present, before clearing the requested
bit on label allocation failure. Leave request callback errors on the
existing path to avoid freeing a failed request.

Fixes: 1f2bcb8c8ccd ("gpio: protect the descriptor label with SRCU")
Signed-off-by: Baek Kyu, Kim <pocj8ur4in@gmail.com>
---
Tested under ARM64 QEMU with failslab, a test GPIO provider using runtime
PM, and gpio-sim. Label allocation failure leaves a PM reference or a
gpio-sim request bit held before the fix; both are released with the fix.
KUnit and GPIO_V2_GET_LINE_IOCTL tests pass, including repeated failures
and retries. No physical GPIO controller was tested.

 drivers/gpio/gpiolib.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index c0394c7d6279..239c0d54843b 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -2627,10 +2627,13 @@ int gpiod_request_commit(struct gpio_desc *desc, const char *label)
 
 	ret = desc_set_label(desc, label ? : "?");
 	if (ret)
-		goto out_clear_bit;
+		goto out_free_gpio;
 
 	return 0;
 
+out_free_gpio:
+	if (guard.gc->free)
+		guard.gc->free(guard.gc, offset);
 out_clear_bit:
 	clear_bit(GPIOD_FLAG_REQUESTED, &desc->flags);
 	return ret;

base-commit: 58161ead29e50d70a317ea26b472e0c7508e69da
-- 
2.55.0

Re: [PATCH] gpiolib: Free chip resources when allocating the label fails

[Bartosz Golaszewski]

On Sun, 18 Oct 2026 13:44:56 +0900, Baek Kyu, Kim wrote:
> If desc_set_label() fails after the chip's request callback succeeds,
> gpiod_request_commit() clears GPIOD_FLAG_REQUESTED without calling the
> free callback. The caller receives an error and has no GPIO to release,
> leaving resources acquired by the request callback held.
> 
> Call the chip's free callback, if present, before clearing the requested
> bit on label allocation failure. Leave request callback errors on the
> existing path to avoid freeing a failed request.
> 
> [...]

Applied, thanks!

[1/1] gpiolib: Free chip resources when allocating the label fails
      https://git.kernel.org/brgl/c/8381e1f15e27087fcb6f07046a526ac8b9b9b2b9

Best regards,
-- 
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>