Re: [PATCH v2 5/6] gpiolib: cdev: don't leak the IRQ name when the chip is removed

[Andy Shevchenko]

On Fri, Oct 16, 2026 at 12:23:37PM +0300, Adrian Ambrozewicz wrote:
> The character device requests line IRQs with a copy of the consumer
> label as the name and frees that copy with the name free_irq() returns.
> Since commit ec8b6f55b981 ("gpio: free irqs that are still requested
> when the chip is being removed"), gpiochip_remove() may free the IRQ
> first and drops the name it gets back. The character device then does
> not get it from its own free_irq() call, which since the previous patch
> it does not even make, so the copy leaks:
> 
>   unreferenced object (size 8):
>     comm "gpio-hold"
>     backtrace:
>       kstrdup
>       kstrdup_and_replace
>       edge_detector_setup
>       linereq_create
>       gpio_ioctl
> 
> Keep the name with the line, or with the v1 line event, and free it
> there whoever freed the IRQ.
> 
> Reproduced with gpio-sim and a line requested with edge detection and
> a consumer label, the chip being removed while the request is open:
> kmemleak reports between 17 and 23 such objects after 30 cycles; with
> this change, none after 100.

...

> struct line {

>  	struct linereq *req;
>  	unsigned int irq;
> +	char *irq_label;

Have you checked this with `pahole`? Is it good layout?

...

> struct lineevent_state {

>  	struct gpio_desc *desc;
>  	u32 eflags;
>  	int irq;
> +	char *irq_label;
>  	wait_queue_head_t wait;
>  	struct notifier_block device_unregistered_nb;
>  	DECLARE_KFIFO(events, struct gpioevent_data, 16);

Ditto.

-- 
With Best Regards,
Andy Shevchenko