[PATCH] gpio: exar: initialize the ID before registering its cleanup

[PATCH] gpio: exar: initialize the ID before registering its cleanup

[Sang-Hoon Choi]

devm_add_action_or_reset() invokes the cleanup action immediately when
registering the action fails.  gpio_exar_probe() currently stores the
allocated ID in exar_gpio only after registering the action, so that
failure makes exar_devm_ida_free() release ID 0.  If the allocated ID is
nonzero, this leaks that ID and can free ID 0 belonging to another device.

Store the ID before registering the cleanup action so both the immediate
failure path and normal device teardown release the correct allocation.

Fixes: 5300ebb695fa ("gpio: exar: use devm action for freeing the IDA and drop remove()")
Reported-by: Changyul Lee <lcy8047@gmail.com>
Assisted-by: LLM
Signed-off-by: Sang-Hoon Choi <csh0052@gmail.com>
---
Compile-tested with x86_64 allmodconfig and W=1.
I have not tested the devres allocation failure with fault injection.

 drivers/gpio/gpio-exar.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpio/gpio-exar.c b/drivers/gpio/gpio-exar.c
index 9053662f18177f735db2cb33fd690b39dcf3fb0b..f629cc526f3ee71ae20e88ec1979f93bc04841e5 100644
--- a/drivers/gpio/gpio-exar.c
+++ b/drivers/gpio/gpio-exar.c
@@ -199,6 +199,7 @@ static int gpio_exar_probe(struct platform_device *pdev)
 	index = ida_alloc(&ida_index, GFP_KERNEL);
 	if (index < 0)
 		return index;
+	exar_gpio->index = index;
 
 	ret = devm_add_action_or_reset(dev, exar_devm_ida_free, exar_gpio);
 	if (ret)
@@ -214,7 +215,6 @@ static int gpio_exar_probe(struct platform_device *pdev)
 	exar_gpio->gpio_chip.set = exar_set_value;
 	exar_gpio->gpio_chip.base = -1;
 	exar_gpio->gpio_chip.ngpio = ngpios;
-	exar_gpio->index = index;
 	exar_gpio->first_pin = first_pin;
 
 	ret = devm_gpiochip_add_data(dev, &exar_gpio->gpio_chip, exar_gpio);
-- 
2.43.0

Re: [PATCH] gpio: exar: initialize the ID before registering its cleanup

[Linus Walleij]

On Tue, Sep 29, 2026 at 7:37 PM Sang-Hoon Choi <csh0052@gmail.com> wrote:

> devm_add_action_or_reset() invokes the cleanup action immediately when
> registering the action fails.  gpio_exar_probe() currently stores the
> allocated ID in exar_gpio only after registering the action, so that
> failure makes exar_devm_ida_free() release ID 0.  If the allocated ID is
> nonzero, this leaks that ID and can free ID 0 belonging to another device.
>
> Store the ID before registering the cleanup action so both the immediate
> failure path and normal device teardown release the correct allocation.
>
> Fixes: 5300ebb695fa ("gpio: exar: use devm action for freeing the IDA and drop remove()")
> Reported-by: Changyul Lee <lcy8047@gmail.com>
> Assisted-by: LLM
> Signed-off-by: Sang-Hoon Choi <csh0052@gmail.com>

This looks right.

Reviewed-by: Linus Walleij <linusw@kernel.org>

Yours,
Linus Walleij

Re: [PATCH] gpio: exar: initialize the ID before registering its cleanup

[Bartosz Golaszewski]

On Wed, 30 Sep 2026 02:37:31 +0900, Sang-Hoon Choi wrote:
> devm_add_action_or_reset() invokes the cleanup action immediately when
> registering the action fails.  gpio_exar_probe() currently stores the
> allocated ID in exar_gpio only after registering the action, so that
> failure makes exar_devm_ida_free() release ID 0.  If the allocated ID is
> nonzero, this leaks that ID and can free ID 0 belonging to another device.
> 
> Store the ID before registering the cleanup action so both the immediate
> failure path and normal device teardown release the correct allocation.
> 
> [...]

Applied, thanks!

[1/1] gpio: exar: initialize the ID before registering its cleanup
      https://git.kernel.org/brgl/c/4d69e74034b208588636ecc177e0dd43a7696af3

Best regards,
-- 
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>