The scan_mask lifetime changed in commit 9a2e1233d38c ("iio: buffer:
hw-consumer: remove redundant scan_mask flexible array").

Before that change, the scan mask storage was embedded in struct
hw_consumer_buffer, so iio_hw_buf_release() could free the whole
allocation with a single kfree(hw_buf).

That commit moved the scan mask to a separate bitmap_zalloc() allocation
stored in buffer.scan_mask, but left iio_hw_buf_release() unchanged.

Free the scan mask in iio_hw_buf_release() before freeing the buffer
wrapper.

Fixes: 9a2e1233d38c ("iio: buffer: hw-consumer: remove redundant scan_mask flexible array")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
---
 drivers/iio/buffer/industrialio-hw-consumer.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/iio/buffer/industrialio-hw-consumer.c b/drivers/iio/buffer/industrialio-hw-consumer.c
index 24d7df603760..d1ab2cbf8c88 100644
--- a/drivers/iio/buffer/industrialio-hw-consumer.c
+++ b/drivers/iio/buffer/industrialio-hw-consumer.c
@@ -40,6 +40,8 @@ static void iio_hw_buf_release(struct iio_buffer *buffer)
 {
 	struct hw_consumer_buffer *hw_buf =
 		iio_buffer_to_hw_consumer_buffer(buffer);
+
+	bitmap_free(buffer->scan_mask);
 	kfree(hw_buf);
 }
 

---
base-commit: 7080e32d3f09d8688c4a87d81bdcc71f7f606b16
change-id: 20260427-iio_buf-0459b3fa3de8

Best regards,
-- 
Felix Gu <ustc.gu@gmail.com>

On Mon, Apr 27, 2026 at 07:11:39PM +0800, Felix Gu wrote:
> The scan_mask lifetime changed in commit 9a2e1233d38c ("iio: buffer:
> hw-consumer: remove redundant scan_mask flexible array").
> 
> Before that change, the scan mask storage was embedded in struct
> hw_consumer_buffer, so iio_hw_buf_release() could free the whole
> allocation with a single kfree(hw_buf).
> 
> That commit moved the scan mask to a separate bitmap_zalloc() allocation
> stored in buffer.scan_mask, but left iio_hw_buf_release() unchanged.
> 
> Free the scan mask in iio_hw_buf_release() before freeing the buffer
> wrapper.
> 
> Fixes: 9a2e1233d38c ("iio: buffer: hw-consumer: remove redundant scan_mask flexible array")
> Signed-off-by: Felix Gu <ustc.gu@gmail.com>
> ---

For some reason this one did not get into my mailbox. Anyways, looks
good and in line with buffer-cb. Thanks for fixing this:

Reviewed-by: Nuno Sá <nuno.sa@analog.com>

>  drivers/iio/buffer/industrialio-hw-consumer.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/iio/buffer/industrialio-hw-consumer.c b/drivers/iio/buffer/industrialio-hw-consumer.c
> index 24d7df603760..d1ab2cbf8c88 100644
> --- a/drivers/iio/buffer/industrialio-hw-consumer.c
> +++ b/drivers/iio/buffer/industrialio-hw-consumer.c
> @@ -40,6 +40,8 @@ static void iio_hw_buf_release(struct iio_buffer *buffer)
>  {
>  	struct hw_consumer_buffer *hw_buf =
>  		iio_buffer_to_hw_consumer_buffer(buffer);
> +
> +	bitmap_free(buffer->scan_mask);
>  	kfree(hw_buf);
>  }
>  
> 
> ---
> base-commit: 7080e32d3f09d8688c4a87d81bdcc71f7f606b16
> change-id: 20260427-iio_buf-0459b3fa3de8
> 
> Best regards,
> -- 
> Felix Gu <ustc.gu@gmail.com>
> 

On Mon, 18 May 2026 09:26:00 +0100
Nuno Sá <noname.nuno@gmail.com> wrote:

> On Mon, Apr 27, 2026 at 07:11:39PM +0800, Felix Gu wrote:
> > The scan_mask lifetime changed in commit 9a2e1233d38c ("iio: buffer:
> > hw-consumer: remove redundant scan_mask flexible array").
> > 
> > Before that change, the scan mask storage was embedded in struct
> > hw_consumer_buffer, so iio_hw_buf_release() could free the whole
> > allocation with a single kfree(hw_buf).
> > 
> > That commit moved the scan mask to a separate bitmap_zalloc() allocation
> > stored in buffer.scan_mask, but left iio_hw_buf_release() unchanged.
> > 
> > Free the scan mask in iio_hw_buf_release() before freeing the buffer
> > wrapper.
> > 
> > Fixes: 9a2e1233d38c ("iio: buffer: hw-consumer: remove redundant scan_mask flexible array")
> > Signed-off-by: Felix Gu <ustc.gu@gmail.com>
> > ---  
> 
> For some reason this one did not get into my mailbox. Anyways, looks
> good and in line with buffer-cb. Thanks for fixing this:
> 
> Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Applied to the fixes-togreg branch of iio.git and marked for stable.

Thanks,

Jonathan

> 
> >  drivers/iio/buffer/industrialio-hw-consumer.c | 2 ++
> >  1 file changed, 2 insertions(+)
> > 
> > diff --git a/drivers/iio/buffer/industrialio-hw-consumer.c b/drivers/iio/buffer/industrialio-hw-consumer.c
> > index 24d7df603760..d1ab2cbf8c88 100644
> > --- a/drivers/iio/buffer/industrialio-hw-consumer.c
> > +++ b/drivers/iio/buffer/industrialio-hw-consumer.c
> > @@ -40,6 +40,8 @@ static void iio_hw_buf_release(struct iio_buffer *buffer)
> >  {
> >  	struct hw_consumer_buffer *hw_buf =
> >  		iio_buffer_to_hw_consumer_buffer(buffer);
> > +
> > +	bitmap_free(buffer->scan_mask);
> >  	kfree(hw_buf);
> >  }
> >  
> > 
> > ---
> > base-commit: 7080e32d3f09d8688c4a87d81bdcc71f7f606b16
> > change-id: 20260427-iio_buf-0459b3fa3de8
> > 
> > Best regards,
> > -- 
> > Felix Gu <ustc.gu@gmail.com>
> >   
> 

On Mon, Apr 27, 2026 at 07:11:39PM +0800, Felix Gu wrote:
> The scan_mask lifetime changed in commit 9a2e1233d38c ("iio: buffer:
> hw-consumer: remove redundant scan_mask flexible array").
> 
> Before that change, the scan mask storage was embedded in struct
> hw_consumer_buffer, so iio_hw_buf_release() could free the whole
> allocation with a single kfree(hw_buf).
> 
> That commit moved the scan mask to a separate bitmap_zalloc() allocation
> stored in buffer.scan_mask, but left iio_hw_buf_release() unchanged.
> 
> Free the scan mask in iio_hw_buf_release() before freeing the buffer
> wrapper.

Good catch!

Seems that struct iio_buffer is a foundation class that is used in several
objects and hence each of them is responsible to allocate/free scan_mask
(and others, if required). That's why it's easy to forget to clean up that
properly. I was thinking of a common ground to have that being done in one
place, but it seems unfeasible.

Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>

-- 
With Best Regards,
Andy Shevchenko