[PATCH] gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe()

[PATCH] gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe()

[Abdun Nihaal]

The memory allocated for priv->blob.data is not freed in the error paths
that follow the fops_buf_size_set() call in gpio_la_poll_probe(), as
well as in the remove function. Fix that by using device managed action
to free the memory on remove.

Fixes: 7828b7bbbf20 ("gpio: add sloppy logic analyzer using polling")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
---
Compile tested only. Issue found using static analysis.

 drivers/gpio/gpio-sloppy-logic-analyzer.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/gpio/gpio-sloppy-logic-analyzer.c b/drivers/gpio/gpio-sloppy-logic-analyzer.c
index 2bbd308ca08e..7b4af98286e8 100644
--- a/drivers/gpio/gpio-sloppy-logic-analyzer.c
+++ b/drivers/gpio/gpio-sloppy-logic-analyzer.c
@@ -160,6 +160,13 @@ static int fops_buf_size_get(void *data, u64 *val)
 	return 0;
 }
 
+static void fops_buf_release(void *data)
+{
+	struct gpio_la_poll_priv *priv = data;
+
+	vfree(priv->blob.data);
+}
+
 static int fops_buf_size_set(void *data, u64 val)
 {
 	struct gpio_la_poll_priv *priv = data;
@@ -237,7 +244,12 @@ static int gpio_la_poll_probe(struct platform_device *pdev)
 	if (ret)
 		return ret;
 
-	fops_buf_size_set(priv, GPIO_LA_DEFAULT_BUF_SIZE);
+	ret = fops_buf_size_set(priv, GPIO_LA_DEFAULT_BUF_SIZE);
+	if (ret)
+		return ret;
+	ret = devm_add_action_or_reset(dev, fops_buf_release, priv);
+	if (ret)
+		return ret;
 
 	priv->descs = devm_gpiod_get_array(dev, "probe", GPIOD_IN);
 	if (IS_ERR(priv->descs))
-- 
2.43.0

Re: [PATCH] gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe()

[Wolfram Sang]

[-- Attachment #1: Type: text/plain, Size: 337 bytes --]

On Fri, Jul 10, 2026 at 12:18:36PM +0530, Abdun Nihaal wrote:

> The memory allocated for priv->blob.data is not freed in the error paths
> that follow the fops_buf_size_set() call in gpio_la_poll_probe(), as
> well as in the remove function.

There is no memory allocated at that time. Hmm, maybe I should add a
comment explaining it.


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH] gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe()

[Wolfram Sang]

[-- Attachment #1: Type: text/plain, Size: 154 bytes --]


> Compile tested only. Issue found using static analysis.

Please update your analyzer to check if the original pointer is NULL.
Which one did you use?


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH] gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe()

[Abdun Nihaal]

Hello,

On Sun, Jul 12, 2026 at 11:27:19AM +0200, Wolfram Sang wrote:
> On Fri, Jul 10, 2026 at 12:18:36PM +0530, Abdun Nihaal wrote:
> 
> > The memory allocated for priv->blob.data is not freed in the error paths
> > that follow the fops_buf_size_set() call in gpio_la_poll_probe(), as
> > well as in the remove function.
> 
> There is no memory allocated at that time. Hmm, maybe I should add a
> comment explaining it.
> 

What I meant was that after the priv->blob.data is allocated
successfully in fops_buf_size_set(), the subsequent error returns in
gpio_la_poll_probe() don't free the buffer, but directly return (since
all the other allocations are device managed). And so I feel that there
is a leak possible here.

    fops_buf_size_set(priv, GPIO_LA_DEFAULT_BUF_SIZE);
    // After a successful allocation in fops_buf_size_set()

    priv->descs = devm_gpiod_get_array(dev, "probe", GPIOD_IN);
    if (IS_ERR(priv->descs))
    	return PTR_ERR(priv->descs);    // Leaks here

    /* artificial limit to keep 1 byte per sample for now */
    if (priv->descs->ndescs > GPIO_LA_MAX_PROBES)
    	return -EFBIG;                  // Leaks here

    // And leaks in all subsequent error paths

If you prefer, I can remove the return code check for theh
fops_buf_size_set() call and just have the devm_add_action_or_reset()
part for releasing.

Also I don't see the buffer getting freed in the remove function
gpio_la_poll_remove(), unless it is implicitly freed by
debugfs_remove_recursive().

We are using a prototype static analysis tool based on LLVM, which we
are building for a research project.

Regards,
Nihaal

Re: [PATCH] gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe()

[Wolfram Sang]

[-- Attachment #1: Type: text/plain, Size: 849 bytes --]

Hi Nihaal,

> What I meant was that after the priv->blob.data is allocated
> successfully in fops_buf_size_set(), the subsequent error returns in
> gpio_la_poll_probe() don't free the buffer, but directly return (since
> all the other allocations are device managed). And so I feel that there
> is a leak possible here.

This is actually true. We should fix this.

> If you prefer, I can remove the return code check for theh
> fops_buf_size_set() call and just have the devm_add_action_or_reset()
> part for releasing.

Yeah, I would like this. I think this part confused me a little when
reviewing. I will accept the patch with the retval check removed.

> We are using a prototype static analysis tool based on LLVM, which we
> are building for a research project.

Well, you got one success report now :)

Thanks and happy hacking,

   Wolfram


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]