[PATCH] pinctrl: core: fix pin name leak on radix_tree_insert() error path

[PATCH] pinctrl: core: fix pin name leak on radix_tree_insert() error path

[Haotian Zhang]

pinctrl_register_one_pin() allocates pindesc->name with kasprintf() when
the pin has no static name, and marks it with pindesc->dynamic_name.  If
the subsequent radix_tree_insert() fails, the function jumps to the
failed label, which only calls kfree(pindesc) and never frees the
dynamically allocated name, leaking it.

Since the insertion failed, the pin is not in the radix tree, so the
caller's pinctrl_free_pindescs() cleanup cannot find it and cannot
release the name either.

Release pindesc->name on the failed path when it was dynamically
allocated.

Fixes: ecfe9a015d3e ("pinctrl: core: handle radix_tree_insert() errors in pinctrl_register_one_pin()")
Assisted-by: DeepSeek-V4.1-Flash
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
---
 drivers/pinctrl/core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
index 1675dd36bd5c..3a1d1ff871ef 100644
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -249,6 +249,8 @@ static int pinctrl_register_one_pin(struct pinctrl_dev *pctldev,
 	return 0;
 
 failed:
+	if (pindesc->dynamic_name)
+		kfree(pindesc->name);
 	kfree(pindesc);
 	return error;
 }
-- 
2.25.1

Re: [PATCH] pinctrl: core: fix pin name leak on radix_tree_insert() error path

[Krzysztof Kozlowski]

On Fri, 09 Oct 2026 13:45:56 +0800, Haotian Zhang wrote:
> pinctrl_register_one_pin() allocates pindesc->name with kasprintf() when
> the pin has no static name, and marks it with pindesc->dynamic_name.  If
> the subsequent radix_tree_insert() fails, the function jumps to the
> failed label, which only calls kfree(pindesc) and never frees the
> dynamically allocated name, leaking it.
> 
> Since the insertion failed, the pin is not in the radix tree, so the
> caller's pinctrl_free_pindescs() cleanup cannot find it and cannot
> release the name either.
> 
> Release pindesc->name on the failed path when it was dynamically
> allocated.
> 
> Fixes: ecfe9a015d3e ("pinctrl: core: handle radix_tree_insert() errors in pinctrl_register_one_pin()")
> Assisted-by: DeepSeek-V4.1-Flash
> Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
> ---
>  drivers/pinctrl/core.c | 2 ++
>  1 file changed, 2 insertions(+)
> 



Multiple things here:
1. Your team ignored completely previous feedback.

2. You use multiple identities with this email, thus I actually doubt we speak
   with actual person.

3. Finally, same feedback:
You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem (so a patchset grouping multiple patches with a short cover
letter), how to document usage of LLM and how what you should not do
if this was posted in a good faith.

Best regards,
Krzysztof

Re: [PATCH] pinctrl: core: fix pin name leak on radix_tree_insert() error path

[Sergey Shtylyov]

On 10/9/26 8:45 AM, Haotian Zhang wrote:

> pinctrl_register_one_pin() allocates pindesc->name with kasprintf() when
> the pin has no static name, and marks it with pindesc->dynamic_name.  If
> the subsequent radix_tree_insert() fails, the function jumps to the
> failed label, which only calls kfree(pindesc) and never frees the
> dynamically allocated name, leaking it.
> 
> Since the insertion failed, the pin is not in the radix tree, so the
> caller's pinctrl_free_pindescs() cleanup cannot find it and cannot
> release the name either.
> 
> Release pindesc->name on the failed path when it was dynamically
> allocated.
> 
> Fixes: ecfe9a015d3e ("pinctrl: core: handle radix_tree_insert() errors in pinctrl_register_one_pin()")
> Assisted-by: DeepSeek-V4.1-Flash
> Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
   Oops, my fault indeed! :-(   If you want, you can add my:
Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru>

[...]

> diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
> index 1675dd36bd5c..3a1d1ff871ef 100644
> --- a/drivers/pinctrl/core.c
> +++ b/drivers/pinctrl/core.c
> @@ -249,6 +249,8 @@ static int pinctrl_register_one_pin(struct pinctrl_dev *pctldev,
>         return 0;
> 
>  failed:
> +       if (pindesc->dynamic_name)
> +               kfree(pindesc->name);

   You may as well add another label here -- for the 1st *goto*...

>         kfree(pindesc);
>         return error;
>  }
[...]
MBR, Sergey