Re: [PATCH v2 6/7] gpiolib: avoid krealloc() in gpiod_get_array()

[Dmitry Torokhov]

On Wed, Nov 04, 2026 at 11:40:18PM +0200, Andy Shevchenko wrote:
> On Wed, Nov 04, 2026 at 10:14:49AM -0800, Dmitry Torokhov wrote:
> > On Wed, Nov 04, 2026 at 02:20:53PM +0200, Andy Shevchenko wrote:
> > > On Tue, Nov 03, 2026 at 07:40:34PM -0800, Dmitry Torokhov wrote:
> > > > +	bitmap_set(array_info->get_mask, 0, count);
> > > > +	bitmap_set(array_info->set_mask, 0, count);
> > >
> > > You don't need these, as memory is nullified.
> > > Also note that we have bitmap_clear() IIRC.
> > 
> > bitmap_set() sets bits 0 .. count - 1 to 1, not 0. Both get_mask and
> > set_mask start with all count bits set (assuming all pins in the array
> > are eligible for the fast path), and then gpio_descs_check_fastpath()
> > clears individual bits for pins that do not qualify.
>
> Ah, indeed, but we still have bitmap_fill().

bitmap_fill(dst, count) fills whole unsigned long words with 0xff
without masking the tail bits in the last word. Here get_mask and
set_mask are sized to max(gdev->ngpio, count) bits and passed to
gpio_chip_get_multiple() and gpiochip_set_multiple(), which iterate up
to gc->ngpio bits.

When count < gdev->ngpio, bitmap_fill(mask, count) would leave bits
count .. round_up(count, BITS_PER_LONG) - 1 set to 1, causing
get_multiple/set_multiple to touch unrelated pins on the chip and access
value_bitmap beyond count bits. So we really need bitmap_set(..., 0,
count) here to set only the first count bits.

Thanks.

-- 
Dmitry