[PATCH v3 0/3] irqdomain: Auto-set IRQ_DOMAIN_FLAG_DESTROY_GC and remove redundant flag from drivers

[PATCH v3 0/3] irqdomain: Auto-set IRQ_DOMAIN_FLAG_DESTROY_GC and remove redundant flag from drivers

[Qingshuang Fu]

This series makes __irq_domain_instantiate() automatically set
IRQ_DOMAIN_FLAG_DESTROY_GC when dgc_info is supplied, avoiding future
memory-leak pitfalls for new callers.

There is no runtime bug in current mainline; all existing in-tree users
already set this flag manually. Patches 2-3 remove those redundant flag
assignments from driver code which uses irq_domain_instantiate().

Note: Some drivers set IRQ_DOMAIN_FLAG_DESTROY_GC with legacy
irq_domain_create_linear() and irq_alloc_domain_generic_chips() APIs
(e.g. renesas-irqc). Those are untouched because they do not go
through __irq_domain_instantiate().

Changes since v2:
 - Drop the Fixes tag, as there is no present-day bug.
 - Turn into patchset, add driver cleanup patches.
 - Reword commit message to clarify risk applies to future callers only.

v2 thread: <https://lore.kernel.org/all/20260904070943.934476-1-fuqingshuang@kylinos.cn/>

Qingshuang Fu (3):
  irqdomain: Set IRQ_DOMAIN_FLAG_DESTROY_GC in __irq_domain_instantiate()
  irqchip/lan966x-oic: Drop redundant IRQ_DOMAIN_FLAG_DESTROY_GC
  soc/fsl/qe: qe_ports_ic: Drop redundant IRQ_DOMAIN_FLAG_DESTROY_GC

 kernel/irq/irqdomain.c                     | 1 +
 drivers/irqchip/irq-lan966x-oic.c          | 1 -
 drivers/soc/fsl/qe/qe_ports_ic.c           | 1 -
 3 files changed, 1 insertion(+), 2 deletions(-)


base-commit: df2908090cda368b01ff43709f51890076c56157
-- 
2.25.1

[PATCH v3 1/3] irqdomain: Set IRQ_DOMAIN_FLAG_DESTROY_GC in __irq_domain_instantiate()

[Qingshuang Fu]

When a driver uses irq_domain_instantiate() with dgc_info to create
generic irq chips, IRQ_DOMAIN_FLAG_DESTROY_GC is required so that
irq_domain_remove() can clean up those generic chips.

All existing in-tree callers manually set this flag today, but this
pattern is error-prone. A future new caller forgetting to set the flag
would leave generic chips allocated by irq_domain_alloc_generic_chips()
leaked on domain removal.

Set IRQ_DOMAIN_FLAG_DESTROY_GC right after
irq_domain_alloc_generic_chips() succeeds inside
__irq_domain_instantiate().  This makes automatic cleanup the default
for all users that provide dgc_info via irq_domain_instantiate().

This is the correct location for the flag because:

  - irq_domain_instantiate() is a high-level wrapper which internally
    allocates the generic chips, so it should also take responsibility
    for arranging their cleanup.

  - Setting the flag in irq_domain_alloc_generic_chips() would affect
    legacy callers like __irq_alloc_domain_generic_chips(), some of
    which have custom cleanup paths that manually free the generic
    chips (e.g. gpio-tb10x does kfree(domain->gc) before
    irq_domain_remove()), leading to use-after-free.

Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
---
 kernel/irq/irqdomain.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index 57c819da30c2..4fdcb6df5306 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -344,6 +344,7 @@ static struct irq_domain *__irq_domain_instantiate(const struct irq_domain_info
 		err = irq_domain_alloc_generic_chips(domain, info->dgc_info);
 		if (err)
 			goto err_domain_free;
+		domain->flags |= IRQ_DOMAIN_FLAG_DESTROY_GC;
 	}
 
 	if (info->init) {
-- 
2.25.1

[PATCH v3 2/3] irqchip/lan966x-oic: Drop redundant IRQ_DOMAIN_FLAG_DESTROY_GC

[Qingshuang Fu]

Now that __irq_domain_instantiate() automatically sets
IRQ_DOMAIN_FLAG_DESTROY_GC when dgc_info is provided, the explicit
flag in the irq_domain_info is redundant.  Remove it.

Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
---
 drivers/irqchip/irq-lan966x-oic.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/irqchip/irq-lan966x-oic.c b/drivers/irqchip/irq-lan966x-oic.c
index 8af08d0e4182..5122f3f1b353 100644
--- a/drivers/irqchip/irq-lan966x-oic.c
+++ b/drivers/irqchip/irq-lan966x-oic.c
@@ -220,7 +220,6 @@ static int lan966x_oic_probe(struct platform_device *pdev)
 	};
 	struct irq_domain_info d_info = {
 		.fwnode		= of_fwnode_handle(pdev->dev.of_node),
-		.domain_flags	= IRQ_DOMAIN_FLAG_DESTROY_GC,
 		.size		= LAN966X_OIC_NR_IRQ,
 		.hwirq_max	= LAN966X_OIC_NR_IRQ,
 		.ops		= &irq_generic_chip_ops,
-- 
2.25.1

[PATCH v3 3/3] soc/fsl/qe: qe_ports_ic: Drop redundant IRQ_DOMAIN_FLAG_DESTROY_GC

[Qingshuang Fu]

Now that __irq_domain_instantiate() automatically sets
IRQ_DOMAIN_FLAG_DESTROY_GC when dgc_info is provided, the explicit
flag in the irq_domain_info is redundant.  Remove it.

Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
---
 drivers/soc/fsl/qe/qe_ports_ic.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/soc/fsl/qe/qe_ports_ic.c b/drivers/soc/fsl/qe/qe_ports_ic.c
index 7375f92f528b..fb3b92039547 100644
--- a/drivers/soc/fsl/qe/qe_ports_ic.c
+++ b/drivers/soc/fsl/qe/qe_ports_ic.c
@@ -140,7 +140,6 @@ static int qepic_probe(struct platform_device *pdev)
 	};
 	struct irq_domain_info d_info = {
 		.fwnode = of_fwnode_handle(pdev->dev.of_node),
-		.domain_flags = IRQ_DOMAIN_FLAG_DESTROY_GC,
 		.size = 32,
 		.hwirq_max = 32,
 		.ops = &irq_generic_chip_ops,
-- 
2.25.1

Re: [PATCH v3 1/3] irqdomain: Set IRQ_DOMAIN_FLAG_DESTROY_GC in __irq_domain_instantiate()

[Herve Codina]

Hi Qingshuang,

On Mon,  7 Sep 2026 10:40:44 +0800
Qingshuang Fu <fuqingshuang@kylinos.cn> wrote:

> When a driver uses irq_domain_instantiate() with dgc_info to create
> generic irq chips, IRQ_DOMAIN_FLAG_DESTROY_GC is required so that
> irq_domain_remove() can clean up those generic chips.
> 
> All existing in-tree callers manually set this flag today, but this
> pattern is error-prone. A future new caller forgetting to set the flag
> would leave generic chips allocated by irq_domain_alloc_generic_chips()
> leaked on domain removal.
> 
> Set IRQ_DOMAIN_FLAG_DESTROY_GC right after
> irq_domain_alloc_generic_chips() succeeds inside
> __irq_domain_instantiate().  This makes automatic cleanup the default
> for all users that provide dgc_info via irq_domain_instantiate().
> 
> This is the correct location for the flag because:
> 
>   - irq_domain_instantiate() is a high-level wrapper which internally
>     allocates the generic chips, so it should also take responsibility
>     for arranging their cleanup.
> 
>   - Setting the flag in irq_domain_alloc_generic_chips() would affect
>     legacy callers like __irq_alloc_domain_generic_chips(), some of
>     which have custom cleanup paths that manually free the generic
>     chips (e.g. gpio-tb10x does kfree(domain->gc) before
>     irq_domain_remove()), leading to use-after-free.
> 
> Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
> ---
>  kernel/irq/irqdomain.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
> index 57c819da30c2..4fdcb6df5306 100644
> --- a/kernel/irq/irqdomain.c
> +++ b/kernel/irq/irqdomain.c
> @@ -344,6 +344,7 @@ static struct irq_domain *__irq_domain_instantiate(const struct irq_domain_info
>  		err = irq_domain_alloc_generic_chips(domain, info->dgc_info);
>  		if (err)
>  			goto err_domain_free;
> +		domain->flags |= IRQ_DOMAIN_FLAG_DESTROY_GC;
>  	}
>  
>  	if (info->init) {

LGTM.

Reviewed-by: Herve Codina <herve.codina@bootlin.com>

Best regards,
Hervé

Re: [PATCH v3 2/3] irqchip/lan966x-oic: Drop redundant IRQ_DOMAIN_FLAG_DESTROY_GC

[Herve Codina]

Hi Qingshuang

On Mon,  7 Sep 2026 10:40:45 +0800
Qingshuang Fu <fuqingshuang@kylinos.cn> wrote:

> Now that __irq_domain_instantiate() automatically sets
> IRQ_DOMAIN_FLAG_DESTROY_GC when dgc_info is provided, the explicit
> flag in the irq_domain_info is redundant.  Remove it.
> 
> Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
> ---
>  drivers/irqchip/irq-lan966x-oic.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/drivers/irqchip/irq-lan966x-oic.c b/drivers/irqchip/irq-lan966x-oic.c
> index 8af08d0e4182..5122f3f1b353 100644
> --- a/drivers/irqchip/irq-lan966x-oic.c
> +++ b/drivers/irqchip/irq-lan966x-oic.c
> @@ -220,7 +220,6 @@ static int lan966x_oic_probe(struct platform_device *pdev)
>  	};
>  	struct irq_domain_info d_info = {
>  		.fwnode		= of_fwnode_handle(pdev->dev.of_node),
> -		.domain_flags	= IRQ_DOMAIN_FLAG_DESTROY_GC,
>  		.size		= LAN966X_OIC_NR_IRQ,
>  		.hwirq_max	= LAN966X_OIC_NR_IRQ,
>  		.ops		= &irq_generic_chip_ops,

Reviewed-by: Herve Codina <herve.codina@bootlin.com>

Best regards,
Hervé

Re: [PATCH v3 3/3] soc/fsl/qe: qe_ports_ic: Drop redundant IRQ_DOMAIN_FLAG_DESTROY_GC

[Herve Codina]

Hi Qingshuang,

On Mon,  7 Sep 2026 10:40:46 +0800
Qingshuang Fu <fuqingshuang@kylinos.cn> wrote:

> Now that __irq_domain_instantiate() automatically sets
> IRQ_DOMAIN_FLAG_DESTROY_GC when dgc_info is provided, the explicit
> flag in the irq_domain_info is redundant.  Remove it.
> 
> Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
> ---
>  drivers/soc/fsl/qe/qe_ports_ic.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/drivers/soc/fsl/qe/qe_ports_ic.c b/drivers/soc/fsl/qe/qe_ports_ic.c
> index 7375f92f528b..fb3b92039547 100644
> --- a/drivers/soc/fsl/qe/qe_ports_ic.c
> +++ b/drivers/soc/fsl/qe/qe_ports_ic.c
> @@ -140,7 +140,6 @@ static int qepic_probe(struct platform_device *pdev)
>  	};
>  	struct irq_domain_info d_info = {
>  		.fwnode = of_fwnode_handle(pdev->dev.of_node),
> -		.domain_flags = IRQ_DOMAIN_FLAG_DESTROY_GC,
>  		.size = 32,
>  		.hwirq_max = 32,
>  		.ops = &irq_generic_chip_ops,

Reviewed-by: Herve Codina <herve.codina@bootlin.com>

Best regards,
Hervé

[tip: irq/drivers] soc/fsl/qe: qe_ports_ic: Drop redundant IRQ_DOMAIN_FLAG_DESTROY_GC

[tip-bot2 for Qingshuang Fu]

The following commit has been merged into the irq/drivers branch of tip:

Commit-ID:     c6d93e52d8c8f05898adf29d3b6edf6570da83af
Gitweb:        https://git.kernel.org/tip/c6d93e52d8c8f05898adf29d3b6edf6570da83af
Author:        Qingshuang Fu <fuqingshuang@kylinos.cn>
AuthorDate:    Mon, 07 Sep 2026 10:40:46 +08:00
Committer:     Thomas Gleixner <tglx@kernel.org>
CommitterDate: Mon, 07 Sep 2026 21:49:58 +02:00

soc/fsl/qe: qe_ports_ic: Drop redundant IRQ_DOMAIN_FLAG_DESTROY_GC

Now that __irq_domain_instantiate() automatically sets
IRQ_DOMAIN_FLAG_DESTROY_GC when dgc_info is provided, the explicit
flag in the irq_domain_info is redundant.  Remove it.

Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Herve Codina <herve.codina@bootlin.com>
Link: https://patch.msgid.link/20260907024046.28845-4-fuqingshuang@kylinos.cn
---
 drivers/soc/fsl/qe/qe_ports_ic.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/soc/fsl/qe/qe_ports_ic.c b/drivers/soc/fsl/qe/qe_ports_ic.c
index 7375f92..fb3b920 100644
--- a/drivers/soc/fsl/qe/qe_ports_ic.c
+++ b/drivers/soc/fsl/qe/qe_ports_ic.c
@@ -140,7 +140,6 @@ static int qepic_probe(struct platform_device *pdev)
 	};
 	struct irq_domain_info d_info = {
 		.fwnode = of_fwnode_handle(pdev->dev.of_node),
-		.domain_flags = IRQ_DOMAIN_FLAG_DESTROY_GC,
 		.size = 32,
 		.hwirq_max = 32,
 		.ops = &irq_generic_chip_ops,

[tip: irq/drivers] irqchip/lan966x-oic: Drop redundant IRQ_DOMAIN_FLAG_DESTROY_GC

[tip-bot2 for Qingshuang Fu]

The following commit has been merged into the irq/drivers branch of tip:

Commit-ID:     404b7900e62b9d5f4ac25c3e2ce757f32e4cc004
Gitweb:        https://git.kernel.org/tip/404b7900e62b9d5f4ac25c3e2ce757f32e4cc004
Author:        Qingshuang Fu <fuqingshuang@kylinos.cn>
AuthorDate:    Mon, 07 Sep 2026 10:40:45 +08:00
Committer:     Thomas Gleixner <tglx@kernel.org>
CommitterDate: Mon, 07 Sep 2026 21:49:58 +02:00

irqchip/lan966x-oic: Drop redundant IRQ_DOMAIN_FLAG_DESTROY_GC

Now that __irq_domain_instantiate() automatically sets
IRQ_DOMAIN_FLAG_DESTROY_GC when dgc_info is provided, the explicit
flag in the irq_domain_info is redundant.  Remove it.

Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Herve Codina <herve.codina@bootlin.com>
Link: https://patch.msgid.link/20260907024046.28845-3-fuqingshuang@kylinos.cn
---
 drivers/irqchip/irq-lan966x-oic.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/irqchip/irq-lan966x-oic.c b/drivers/irqchip/irq-lan966x-oic.c
index 8af08d0..5122f3f 100644
--- a/drivers/irqchip/irq-lan966x-oic.c
+++ b/drivers/irqchip/irq-lan966x-oic.c
@@ -220,7 +220,6 @@ static int lan966x_oic_probe(struct platform_device *pdev)
 	};
 	struct irq_domain_info d_info = {
 		.fwnode		= of_fwnode_handle(pdev->dev.of_node),
-		.domain_flags	= IRQ_DOMAIN_FLAG_DESTROY_GC,
 		.size		= LAN966X_OIC_NR_IRQ,
 		.hwirq_max	= LAN966X_OIC_NR_IRQ,
 		.ops		= &irq_generic_chip_ops,

[tip: irq/drivers] irqdomain: Set IRQ_DOMAIN_FLAG_DESTROY_GC in __irq_domain_instantiate()

[tip-bot2 for Qingshuang Fu]

The following commit has been merged into the irq/drivers branch of tip:

Commit-ID:     0aa45dce2afe6960865de1f32fabd716efaa6fdb
Gitweb:        https://git.kernel.org/tip/0aa45dce2afe6960865de1f32fabd716efaa6fdb
Author:        Qingshuang Fu <fuqingshuang@kylinos.cn>
AuthorDate:    Mon, 07 Sep 2026 10:40:44 +08:00
Committer:     Thomas Gleixner <tglx@kernel.org>
CommitterDate: Mon, 07 Sep 2026 21:49:58 +02:00

irqdomain: Set IRQ_DOMAIN_FLAG_DESTROY_GC in __irq_domain_instantiate()

When a driver uses irq_domain_instantiate() with dgc_info to create
generic irq chips, IRQ_DOMAIN_FLAG_DESTROY_GC is required so that
irq_domain_remove() can clean up those generic chips.

All existing in-tree callers manually set this flag today, but this
pattern is error-prone. A future new caller forgetting to set the flag
would leave generic chips allocated by irq_domain_alloc_generic_chips()
leaked on domain removal.

Set IRQ_DOMAIN_FLAG_DESTROY_GC right after
irq_domain_alloc_generic_chips() succeeds inside
__irq_domain_instantiate().  This makes automatic cleanup the default
for all users that provide dgc_info via irq_domain_instantiate().

This is the correct location for the flag because:

  - irq_domain_instantiate() is a high-level wrapper which internally
    allocates the generic chips, so it should also take responsibility
    for arranging their cleanup.

  - Setting the flag in irq_domain_alloc_generic_chips() would affect
    legacy callers like __irq_alloc_domain_generic_chips(), some of
    which have custom cleanup paths that manually free the generic
    chips (e.g. gpio-tb10x does kfree(domain->gc) before
    irq_domain_remove()), leading to use-after-free.

Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Herve Codina <herve.codina@bootlin.com>
Link: https://patch.msgid.link/20260907024046.28845-2-fuqingshuang@kylinos.cn
---
 kernel/irq/irqdomain.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index 57c819d..4fdcb6d 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -344,6 +344,7 @@ static struct irq_domain *__irq_domain_instantiate(const struct irq_domain_info 
 		err = irq_domain_alloc_generic_chips(domain, info->dgc_info);
 		if (err)
 			goto err_domain_free;
+		domain->flags |= IRQ_DOMAIN_FLAG_DESTROY_GC;
 	}
 
 	if (info->init) {