7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Baek Kyu, Kim [ Upstream commit 8381e1f15e27087fcb6f07046a526ac8b9b9b2b9 ] If desc_set_label() fails after the chip's request callback succeeds, gpiod_request_commit() clears GPIOD_FLAG_REQUESTED without calling the free callback. The caller receives an error and has no GPIO to release, leaving resources acquired by the request callback held. Call the chip's free callback, if present, before clearing the requested bit on label allocation failure. Leave request callback errors on the existing path to avoid freeing a failed request. Cc: stable@vger.kernel.org Fixes: 1f2bcb8c8ccd ("gpio: protect the descriptor label with SRCU") Signed-off-by: Baek Kyu, Kim Link: https://patch.msgid.link/20261018044456.1259250-1-pocj8ur4in@gmail.com Signed-off-by: Bartosz Golaszewski Signed-off-by: Sasha Levin --- drivers/gpio/gpiolib.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c index c0394c7d6279b..239c0d54843b3 100644 --- a/drivers/gpio/gpiolib.c +++ b/drivers/gpio/gpiolib.c @@ -2627,10 +2627,13 @@ int gpiod_request_commit(struct gpio_desc *desc, const char *label) ret = desc_set_label(desc, label ? : "?"); if (ret) - goto out_clear_bit; + goto out_free_gpio; return 0; +out_free_gpio: + if (guard.gc->free) + guard.gc->free(guard.gc, offset); out_clear_bit: clear_bit(GPIOD_FLAG_REQUESTED, &desc->flags); return ret; -- 2.53.0