[PATCH v3 0/6] gpiolib: fix chip removal with lines still requested from user space

[Adrian Ambrozewicz]

Removing a GPIO chip while user space holds a line request, as when a
hot-pluggable GPIO controller goes away, leaks the line labels (patch 2)
and IRQ names (patch 5), frees IRQs a second time (patches 3, 6) and
lets a blocked read() stall the removal (patch 4). Patch 1 makes
gpiodev_release() wait for pending label frees; without it,
cleanup_srcu_struct() can warn, more often with patch 2.

Patch 6 changes the order in gpiochip_remove() for in-kernel users too:
the IRQs they leave requested are now freed after the chip pointer is
cleared, when gpiod_*() calls on the chip fail.

User-visible change: a read() blocked when the chip is removed returns
the queued events, if any, and then fails with -ENODEV, instead of
staying blocked until a signal or an event.

For stable: patch 2 needs patch 1; patches 3, 5 and 6 fix a commit from
6.13 that 6.12.y also has; patch 4 applies to 6.12.y, older trees need a
different change.

Tested under QEMU (x86_64, 4 vCPUs) with gpio-sim and a test-only chip
on the hierarchical irqchip, on lockdep, kmemleak and KASAN builds:
each reproducer warns, leaks or hangs without its patch and passes with
it. v2 has the details.

An LLM assistant helped with the analysis, the reproducers and the
drafts, hence the Assisted-by tags; I reviewed and tested every change.

Changes in v3:
- Rebased on gpio/for-current.
- Patch 6: return early when there is no ->to_irq(); drop the comment
  in lineevent_free() (Kent).
- Shorter commit messages (Kent, Bartosz).
- Sashiko's finding on v2 6/6, the gpiochip_add_data_with_key() error
  path after the character device is registered, is on mainline too; I
  plan to send a fix for it on top of this series.
- Link to v2: https://lore.kernel.org/r/20261016-gpiolib-chip-removal-v2-0-aambrozewicz@xxxxxxxxxx
- Link to v1: https://lore.kernel.org/r/20261012-gpiolib-chip-removal-v1-0-aambrozewicz@xxxxxxxxxx

Adrian Ambrozewicz (6):
  gpiolib: wait for pending label frees before cleaning up desc_srcu
  gpiolib: free the label of lines released after their chip was removed
  gpiolib: cdev: do not free line IRQs again after the chip is removed
  gpiolib: cdev: don't sleep in the SRCU read section in read()
  gpiolib: cdev: don't leak the IRQ name when the chip is removed
  gpiolib: let the character device free its IRQs first on chip removal

 drivers/gpio/gpiolib-cdev.c | 145 +++++++++++++++++++++++++++---------
 drivers/gpio/gpiolib.c      |  38 ++++++++--
 2 files changed, 138 insertions(+), 45 deletions(-)


base-commit: 974d2712cb15014019595799b3ed68fef5fe9695
-- 
2.43.0