mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Lee Jones <lee@kernel.org>
To: lee@kernel.org, Tony Lindgren <tony@atomide.com>,
	Haojian Zhuang <haojian.zhuang@linaro.org>,
	Linus Walleij <linusw@kernel.org>,
	linux-arm-kernel@lists.infradead.org, linux-omap@vger.kernel.org,
	linux-gpio@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
Subject: [PATCH 08/10] pinctrl: single: Free pinconf settings array in pcs_dt_free_map()
Date: Wed, 11 Nov 2026 21:51:53 +0000	[thread overview]
Message-ID: <20261111215256.1982044-9-lee@kernel.org> (raw)
In-Reply-To: <20261111215256.1982044-1-lee@kernel.org>

pcs_parse_pinconf() allocates a settings array via devm_kcalloc() on the
pin controller device and attaches it to map[1].data.configs.configs.
When the pinctrl core copies the map entries into its internal tables or
tears down a consumer device mapping, it invokes pcs_dt_free_map(),
which only frees the outer map array and leaves the per-map configs
array allocated on pcs->dev until the pin controller itself is unbound.

Free map[i].data.configs.configs for PIN_MAP_TYPE_CONFIGS_GROUP entries
in pcs_dt_free_map().

Fixes: 9dddb4df90d1 ("pinctrl: single: support generic pinconf")
Closes: https://sashiko.dev/#/bug/linux-fcedec46-4487-4392-a882-3d3bef07e56f
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/pinctrl/pinctrl-single.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
index 13e0ae8bb389..fcd86dbf6869 100644
--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -311,9 +311,13 @@ static void pcs_pin_dbg_show(struct pinctrl_dev *pctldev,
 static void pcs_dt_free_map(struct pinctrl_dev *pctldev,
 				struct pinctrl_map *map, unsigned num_maps)
 {
-	struct pcs_device *pcs;
+	struct pcs_device *pcs = pinctrl_dev_get_drvdata(pctldev);
+
+	for (unsigned int i = 0; i < num_maps; i++) {
+		if (map[i].type == PIN_MAP_TYPE_CONFIGS_GROUP)
+			devm_kfree(pcs->dev, map[i].data.configs.configs);
+	}
 
-	pcs = pinctrl_dev_get_drvdata(pctldev);
 	devm_kfree(pcs->dev, map);
 }
 
-- 
2.56.0.567.gdb80ae8cd5-goog


  parent reply	other threads:[~2026-11-11 21:54 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-11-11 21:51 [PATCH 00/10] pinctrl: Fix resource leaks, out-of-bounds accesses, and error handling (batch 2) Lee Jones
2026-11-11 21:51 ` [PATCH 01/10] pinctrl: nuvoton: ma35: Unmap reg_base and release clock on probe error Lee Jones
2026-11-11 21:51 ` [PATCH 02/10] pinctrl: nuvoton: ma35: Prevent out-of-bounds write in ma35_pinctrl_get_soc_data() Lee Jones
2026-11-11 21:51 ` [PATCH 03/10] pinctrl: nuvoton: ma35: Assign fwnode to gpio_chip in ma35_gpiolib_register() Lee Jones
2026-11-11 21:51 ` [PATCH 04/10] pinctrl: nuvoton: ma35: Avoid leaking map when parent node is missing Lee Jones
2026-11-11 21:51 ` [PATCH 05/10] pinctrl: nuvoton: npcm8xx: Propagate npcm8xx_gpio_register() error in probe Lee Jones
2026-11-11 21:51 ` [PATCH 06/10] pinctrl: nuvoton: npcm7xx: Fix fwnode_irq_get() error check in npcm7xx_gpio_of() Lee Jones
2026-11-11 21:51 ` [PATCH 07/10] pinctrl: single: Reject invalid register width in pcs_probe() Lee Jones
2026-11-11 21:51 ` Lee Jones [this message]
2026-11-11 21:51 ` [PATCH 09/10] pinctrl: sunplus: Validate pin_func index in sppctl_dt_node_to_map() Lee Jones
2026-11-11 21:51 ` [PATCH 10/10] pinctrl: realtek: rtd1625: Set dcycle_offset to NA for pins without duty-cycle support Lee Jones

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261111215256.1982044-9-lee@kernel.org \
    --to=lee@kernel.org \
    --cc=haojian.zhuang@linaro.org \
    --cc=linusw@kernel.org \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-gpio@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-omap@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=tony@atomide.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®