[PATCH] gpiolib: Fix shared GPIO memory leaks

From: Daniel J Blueman

Date: Fri Feb 20 2026 - 04:37:31 EST


On a Snapdragon X1 Elite laptop (Lenovo Yoga Slim 7x), kmemleak reports
three sets of:

unreferenced object 0xffff00080187f400 (size 1024):
comm "swapper/0", pid 1, jiffies 4294667327
hex dump (first 32 bytes):
58 bd 70 01 08 00 ff ff 58 bd 70 01 08 00 ff ff X.p.....X.p.....
00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................
backtrace (crc 1665d1f8):
kmemleak_alloc+0xf4/0x12c
__kmalloc_cache_noprof+0x370/0x49c
gpio_shared_make_ref+0x70/0x16c
gpio_shared_of_traverse+0x4e8/0x5f4
gpio_shared_of_traverse+0x200/0x5f4
gpio_shared_of_traverse+0x200/0x5f4
gpio_shared_of_traverse+0x200/0x5f4
gpio_shared_of_traverse+0x200/0x5f4
gpio_shared_init+0x34/0x1c4
do_one_initcall+0x50/0x280
kernel_init_freeable+0x290/0x33c
kernel_init+0x28/0x14c
ret_from_fork+0x10/0x20

unreferenced object 0xffff00080170c140 (size 8):
comm "swapper/0", pid 1, jiffies 4294667327
hex dump (first 8 bytes):
72 65 73 65 74 00 00 00 reset...
backtrace (crc fc24536):
kmemleak_alloc+0xf4/0x12c
__kmalloc_node_track_caller_noprof+0x3c4/0x584
kstrdup+0x4c/0xcc
gpio_shared_make_ref+0x8c/0x16c
gpio_shared_of_traverse+0x4e8/0x5f4
gpio_shared_of_traverse+0x200/0x5f4
gpio_shared_of_traverse+0x200/0x5f4
gpio_shared_of_traverse+0x200/0x5f4
gpio_shared_of_traverse+0x200/0x5f4
gpio_shared_init+0x34/0x1c4
do_one_initcall+0x50/0x280
kernel_init_freeable+0x290/0x33c
kernel_init+0x28/0x14c
ret_from_fork+0x10/0x20

Fix this by decrementing the reference count of each list entry rather than
only the first.

Fix verified on the same laptop.

Fixes: a060b8c511abb gpiolib: implement low-level, shared GPIO support
Signed-off-by: Daniel J Blueman <daniel@xxxxxxxxx>
---
drivers/gpio/gpiolib-shared.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpio/gpiolib-shared.c b/drivers/gpio/gpiolib-shared.c
index 9e6544203439..e16f467b72e7 100644
--- a/drivers/gpio/gpiolib-shared.c
+++ b/drivers/gpio/gpiolib-shared.c
@@ -753,14 +753,14 @@ static bool gpio_shared_entry_is_really_shared(struct gpio_shared_entry *entry)
static void gpio_shared_free_exclusive(void)
{
struct gpio_shared_entry *entry, *epos;
+ struct gpio_shared_ref *ref, *rpos;

list_for_each_entry_safe(entry, epos, &gpio_shared_list, list) {
if (gpio_shared_entry_is_really_shared(entry))
continue;

- gpio_shared_drop_ref(list_first_entry(&entry->refs,
- struct gpio_shared_ref,
- list));
+ list_for_each_entry_safe(ref, rpos, &entry->refs, list)
+ gpio_shared_drop_ref(ref);
gpio_shared_drop_entry(entry);
}
}
--
2.51.0