Re: [PATCH v2 1/7] gpiolib: fix GPIO descriptor leak in gpiod_get_array()

[Andy Shevchenko <andriy.shevchenko@intel.com>]

On Tue, Nov 03, 2026 at 07:40:29PM -0800, Dmitry Torokhov wrote:
> In gpiod_get_array(), descs->ndescs is used as the loop induction
> variable and is only incremented at the end of each iteration. When
> krealloc() fails on the first iteration (when index is 0), descs->desc[0]
> has already been acquired via gpiod_get_index(), but descs->ndescs is
> still 0. Consequently, gpiod_put_array() frees descs without releasing
> descs->desc[0], leaking the descriptor.
> 
> Fix this by using a dedicated loop induction variable and incrementing
> descs->ndescs immediately upon storing the retrieved descriptor.
> Additionally, since the fast-path array_info setup only executes for
> the first element (index 0), simplify the bitmap_set() calls to start at
> bit 0 for count bits instead of calculating offsets from the loop index.

...

> -	int count, bitmap_size;
> +	int i, count, bitmap_size;

Why not define it inside the for-loop?

...

> -	for (descs->ndescs = 0; descs->ndescs < count; descs->ndescs++) {
> -		desc = gpiod_get_index(dev, con_id, descs->ndescs, flags);
> +	for (i = 0; i < count; i++) {

	for (int i = 0; i < count; i++) {

-- 
With Best Regards,
Andy Shevchenko