From dae739137441667d67fbfcc4d303a0ecc6618662 Mon Sep 17 00:00:00 2001 From: Adrian Ambrozewicz Date: Thu, 22 Oct 2026 11:33:44 +0300 Subject: [PATCH] gpiolib: don't report -ENOMEM for a requested line without a label gpiod_request_commit() sets GPIOD_FLAG_REQUESTED, calls ->request() and only then sets the label. A line in between has no label, so gpiochip_dup_line_label() passes NULL to kstrdup() and returns ERR_PTR(-ENOMEM), which for_each_hwgpio() then passes to kfree(): BUG: unable to handle page fault for address: ffcc73074355ffc8 Call Trace: gpio_sim_dbg_show gpiolib_seq_show seq_read_iter Return NULL for such a line, as for an unrequested one. Reproduced with gpio-sim: reading /sys/kernel/debug/gpio in a loop while lines are requested and released oopses within seconds; with this change, 100000 cycles pass. Fixes: 35b545332b80 ("gpio: remove gpio_lock") Cc: stable@vger.kernel.org Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20261020-gpiolib-chip-removal-v3-0-aambrozewicz@nvidia.com?part=2 Assisted-by: LLM Signed-off-by: Adrian Ambrozewicz Link: https://patch.msgid.link/20261022083343.3905973-3-aambrozewicz@nvidia.com Signed-off-by: Bartosz Golaszewski --- drivers/gpio/gpiolib.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c index 9decee5a95c7..90731a547ed6 100644 --- a/drivers/gpio/gpiolib.c +++ b/drivers/gpio/gpiolib.c @@ -2721,6 +2721,7 @@ void gpiod_free(struct gpio_desc *desc) char *gpiochip_dup_line_label(struct gpio_chip *gc, unsigned int offset) { struct gpio_desc *desc; + const char *name; char *label; desc = gpiochip_get_desc(gc, offset); @@ -2732,7 +2733,11 @@ char *gpiochip_dup_line_label(struct gpio_chip *gc, unsigned int offset) guard(srcu)(&desc->gdev->desc_srcu); - label = kstrdup(gpiod_get_label(desc), GFP_KERNEL); + name = gpiod_get_label(desc); + if (!name) + return NULL; + + label = kstrdup(name, GFP_KERNEL); if (!label) return ERR_PTR(-ENOMEM);