[PATCH v4 0/7] gpiolib: fix chip removal with lines still requested from user space

[Adrian Ambrozewicz]

Removing a GPIO chip while user space holds a line request, as when a
hot-pluggable GPIO controller goes away, leaks the line labels (patch 2)
and IRQ names (patch 5), frees IRQs a second time (patches 3, 7) and
lets a blocked read() stall the removal (patch 4). Patch 1 makes
gpiodev_release() wait for pending label frees; without it,
cleanup_srcu_struct() can warn, more often with patch 2.

Patch 7 changes gpiochip_remove() for in-kernel users too: their
remaining IRQs are freed after the chip pointer is cleared, when
gpiod_*() calls fail. Patch 6 drops edge events when the line read
fails, so an IRQ thread in that window does not report -ENODEV as
a rising edge.

User-visible change: a read() blocked when the chip is removed returns
the queued events, then fails with -ENODEV.

For stable: patch 2 needs 1; patches 3, 5 and 7 fix a 6.13 commit also
in 6.12.y; patch 7 needs 6; patch 4 applies to 6.12.y.

Tested under QEMU (x86_64, 4 vCPUs) with gpio-sim and a test chip on
the hierarchical irqchip, with lockdep, kmemleak and KASAN. An LLM
assistant helped with the analysis, reproducers and drafts, hence the
Assisted-by tags; I reviewed and tested every change.

Changes in v4:
- Rebased on gpio/for-current.
- New patch 6: drop edge events when a line read fails, before patch 7
  frees the character device IRQs after gdev->chip is cleared (Sashiko).
- Patch 2: for_each_hwgpio() seeing a requested line with a NULL label
  is on mainline's request path too; applied separately (Sashiko):
  https://lore.kernel.org/r/20261022083343.3905973-3-aambrozewicz@xxxxxxxxxx
- Patch 5: moving irq_label above irq in struct line moves the 4-byte
  hole rather than removing it (Andy).
- Link to v3: https://lore.kernel.org/r/20261020-gpiolib-chip-removal-v3-0-aambrozewicz@xxxxxxxxxx

Changes in v3:
- Rebased on gpio/for-current; shorter commit messages (Kent, Bartosz).
- Patch 6 (now 7): return early when there is no ->to_irq(); drop the
  lineevent_free() comment (Kent).
- Sashiko's v2 6/6 finding on gpiochip_setup_dev() is on mainline too;
  I plan a separate fix on top of this series.
- Link to v2: https://lore.kernel.org/r/20261016-gpiolib-chip-removal-v2-0-aambrozewicz@xxxxxxxxxx
- Link to v1: https://lore.kernel.org/r/20261012-gpiolib-chip-removal-v1-0-aambrozewicz@xxxxxxxxxx

Adrian Ambrozewicz (7):
  gpiolib: wait for pending label frees before cleaning up desc_srcu
  gpiolib: free the label of lines released after their chip was removed
  gpiolib: cdev: do not free line IRQs again after the chip is removed
  gpiolib: cdev: don't sleep in the SRCU read section in read()
  gpiolib: cdev: don't leak the IRQ name when the chip is removed
  gpiolib: cdev: don't report a failed line read as an edge
  gpiolib: let the character device free its IRQs first on chip removal

 drivers/gpio/gpiolib-cdev.c | 155 +++++++++++++++++++++++++++---------
 drivers/gpio/gpiolib.c      |  38 +++++++--
 2 files changed, 147 insertions(+), 46 deletions(-)


base-commit: baa14758afb3e2828de1f76511edc1de50216f39
-- 
2.43.0