Re: [PATCH 08/13] pcmcia: replace linux/gpio.h inclusions

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Invalid resource cleanup on error path leading to potential double-free of a devres-managed GPIO descriptor.
--

commit a1a20647914d78d6a15655dea889e9d53c734136
Author: Arnd Bergmann <arnd@arndb.de>

pcmcia: replace linux/gpio.h inclusions

The pcmcia drivers all use the legacy interfaces, so convert to
include linux/gpio/legacy.h instead.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>

[ ... ]

> diff --git a/drivers/pcmcia/sa1100_h3600.c b/drivers/pcmcia/sa1100_h3600.c
> index 10cb99c20a7f5..6c52d90795eb4 100644
> --- a/drivers/pcmcia/sa1100_h3600.c
> +++ b/drivers/pcmcia/sa1100_h3600.c
> @@ -11,7 +11,7 @@
>  #include <linux/interrupt.h>
>  #include <linux/init.h>
>  #include <linux/delay.h>
> -#include <linux/gpio.h>
> +#include <linux/gpio/legacy.h>

[Severity: High]
This isn't a bug introduced by this patch, but I noticed a pre-existing
issue while reviewing the GPIO include changes.

Does the error path in h3600_pcmcia_hw_init() cause a double-free of a
devres-managed GPIO descriptor?

If gpio_request(H3XXX_EGPIO_OPT_NVRAM_ON) or subsequent legacy GPIO requests
fail, the code jumps to or falls through to the err01 label:

drivers/pcmcia/sa1100_h3600.c:h3600_pcmcia_hw_init() {
    ...
err06:  gpio_free(H3XXX_EGPIO_CARD_RESET);
err05:  gpio_free(H3XXX_EGPIO_OPT_RESET);
err04:  gpio_free(H3XXX_EGPIO_OPT_ON);
err03:  gpio_free(H3XXX_EGPIO_OPT_NVRAM_ON);
err01:  gpio_free(H3XXX_GPIO_PCMCIA_IRQ0);
        return err;
}

The err01 label incorrectly frees H3XXX_GPIO_PCMCIA_IRQ0. This GPIO is
managed by devres and was not explicitly requested using gpio_request() in
this function. 

When devres cleans up the failed probe, it will attempt to free the GPIO
again. This could lead to a double-free, gpiolib state corruption, kernel
warnings, or accidentally freeing a GPIO acquired by a concurrent driver.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260629132633.1300009-1-arnd@kernel.org?part=8