[PATCH v5 0/4] Some Minor fixes and cleanups to irqchip/gic-v3-its

[PATCH v5 0/4] Some Minor fixes and cleanups to irqchip/gic-v3-its

[Kemeng Shi]

There are some random fixes and cleanups to irqchip/gic-v3-its. More
details can be found in respective patches.
Thanks.

v1->v2:
- Drop unneeded patches and some minor improvement.
v2->v3:
- Fix an extra leak issue in its_vpe_irq_domain_alloc().
- Remove redundant check in its_vpe_db_proxy_unmap_locked()
v3->v4:
- Add missing Fixes tags
- Improve changelog description
v4->v5:
- Collect RVB from Radu
- Drop more unneeded patches
- Use existing error handling to do its_vpe_teardown() in patch 3/4

Kemeng Shi (4):
  irqchip/gic-v3-its: Fix memleak in its_probe_one()
  irqchip/gic-v3-its: Fix its node leak in gic_acpi_parse_madt_its()
  irqchip/gic-v3-its: Fix leak in its_vpe_irq_domain_alloc()
  irqchip/gic-v3-its: Fix grammar and replace a bit number with its
    symbol

 drivers/irqchip/irq-gic-v3-its.c | 29 +++++++++++++++++++----------
 1 file changed, 19 insertions(+), 10 deletions(-)

-- 
2.36.1

[PATCH v5 1/4] irqchip/gic-v3-its: Fix memleak in its_probe_one()

[Kemeng Shi]

Fix collection leak when its_init_domain() failed in its_probe_one().

Fixes: 4c21f3c26ecc2 ("irqchip: GICv3: ITS: DT probing and initialization")
Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
Reviewed-by: Radu Rendec <radu@rendec.net>
---
 drivers/irqchip/irq-gic-v3-its.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 291d7668cc8d..d721b6101e0a 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -5326,7 +5326,7 @@ static int __init its_probe_one(struct its_node *its)
 
 	err = its_init_domain(its);
 	if (err)
-		goto out_free_tables;
+		goto out_free_col;
 
 	raw_spin_lock(&its_lock);
 	list_add(&its->entry, &its_nodes);
@@ -5334,6 +5334,8 @@ static int __init its_probe_one(struct its_node *its)
 
 	return 0;
 
+out_free_col:
+	kfree(its->collections);
 out_free_tables:
 	its_free_tables(its);
 out_free_cmd:
-- 
2.36.1

[PATCH v5 2/4] irqchip/gic-v3-its: Fix its node leak in gic_acpi_parse_madt_its()

[Kemeng Shi]

Fix its node leak when its_probe_one() failed in
gic_acpi_parse_madt_its().

Fixes: 9585a495ac936 ("irqchip/gic-v3-its: Split allocation from initialisation of its_node")
Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
Reviewed-by: Radu Rendec <radu@rendec.net>
---
 drivers/irqchip/irq-gic-v3-its.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index d721b6101e0a..3e4edcb64065 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -5747,9 +5747,13 @@ static int __init gic_acpi_parse_madt_its(union acpi_subtable_headers *header,
 		its->flags |= ITS_FLAGS_FORCE_NON_SHAREABLE;
 
 	err = its_probe_one(its);
-	if (!err)
-		return 0;
+	if (err)
+		goto probe_err;
+
+	return 0;
 
+probe_err:
+	its_node_destroy(its);
 node_err:
 	iort_deregister_domain_token(its_entry->translation_id);
 dom_err:
-- 
2.36.1

[PATCH v5 3/4] irqchip/gic-v3-its: Fix leak in its_vpe_irq_domain_alloc()

[Kemeng Shi]

When its_irq_gic_domain_alloc() fails, the following
its_vpe_irq_domain_free() skips calling its_vep_teardown() for the
corresponding irq. Try its_vpe_teardown() in error handling to avoid
the leak issue.

Fixes: 7d75bbb4bc1ad ("irqchip/gic-v3-its: Add VPE irq domain allocation/teardown")
Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
---
 drivers/irqchip/irq-gic-v3-its.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 3e4edcb64065..5dc91862fc15 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -4594,9 +4594,11 @@ static int its_vpe_init(struct its_vpe *vpe)
 
 static void its_vpe_teardown(struct its_vpe *vpe)
 {
-	its_vpe_db_proxy_unmap(vpe);
-	its_vpe_id_free(vpe->vpe_id);
-	its_free_pending_table(vpe->vpt_page);
+	if (vpe->vpt_page != NULL) {
+		its_vpe_db_proxy_unmap(vpe);
+		its_vpe_id_free(vpe->vpe_id);
+		its_free_pending_table(vpe->vpt_page);
+	}
 }
 
 static void its_vpe_irq_domain_free(struct irq_domain *domain,
@@ -4674,8 +4676,10 @@ static int its_vpe_irq_domain_alloc(struct irq_domain *domain, unsigned int virq
 		irqd_set_resend_when_in_progress(irq_get_irq_data(virq + i));
 	}
 
-	if (err)
+	if (err) {
+		its_vpe_teardown(vm->vpes[i]);
 		its_vpe_irq_domain_free(domain, virq, i);
+	}
 
 	return err;
 }
-- 
2.36.1

[PATCH v5 4/4] irqchip/gic-v3-its: Fix grammar and replace a bit number with its symbol

[Kemeng Shi]

Fix grammatical errors in comments and simplify the comment about reading
GITS_BASER_INDIRECT to check two-level support.

Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
---
 drivers/irqchip/irq-gic-v3-its.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 5dc91862fc15..8935a6e7a20f 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -163,7 +163,7 @@ struct event_lpi_map {
 
 /*
  * The ITS view of a device - belongs to an ITS, owns an interrupt
- * translation table, and a list of interrupts.  If it some of its
+ * translation table, and a list of interrupts.  If some of its
  * LPIs are injected into a guest (GICv4), the event_map.vm field
  * indicates which one.
  */
@@ -2502,8 +2502,7 @@ static bool its_parse_indirect_baser(struct its_node *its,
 	/* No need to enable Indirection if memory requirement < (psz*2)bytes */
 	if ((esz << ids) > (psz * 2)) {
 		/*
-		 * Find out whether hw supports a single or two-level table by
-		 * table by reading bit at offset '62' after writing '1' to it.
+		 * Find out whether hw supports a single or two-level table
 		 */
 		its_write_baser(its, baser, val | GITS_BASER_INDIRECT);
 		indirect = !!(baser->val & GITS_BASER_INDIRECT);
-- 
2.36.1

Re: [PATCH v5 3/4] irqchip/gic-v3-its: Fix leak in its_vpe_irq_domain_alloc()

[Marc Zyngier]

On Mon, 20 Jul 2026 08:12:14 +0100,
Kemeng Shi <shikemeng@huaweicloud.com> wrote:
> 
> When its_irq_gic_domain_alloc() fails, the following
> its_vpe_irq_domain_free() skips calling its_vep_teardown() for the
> corresponding irq. Try its_vpe_teardown() in error handling to avoid
> the leak issue.
> 
> Fixes: 7d75bbb4bc1ad ("irqchip/gic-v3-its: Add VPE irq domain allocation/teardown")
> Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
> ---
>  drivers/irqchip/irq-gic-v3-its.c | 12 ++++++++----
>  1 file changed, 8 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
> index 3e4edcb64065..5dc91862fc15 100644
> --- a/drivers/irqchip/irq-gic-v3-its.c
> +++ b/drivers/irqchip/irq-gic-v3-its.c
> @@ -4594,9 +4594,11 @@ static int its_vpe_init(struct its_vpe *vpe)
>  
>  static void its_vpe_teardown(struct its_vpe *vpe)
>  {
> -	its_vpe_db_proxy_unmap(vpe);
> -	its_vpe_id_free(vpe->vpe_id);
> -	its_free_pending_table(vpe->vpt_page);
> +	if (vpe->vpt_page != NULL) {
> +		its_vpe_db_proxy_unmap(vpe);
> +		its_vpe_id_free(vpe->vpe_id);
> +		its_free_pending_table(vpe->vpt_page);
> +	}

Please keep the diff minimal by doing an early return. This also
deserves a comment, because this is not completely obvious:

diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 6f5811aae59c1..38032067135b6 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -4592,6 +4592,13 @@ static int its_vpe_init(struct its_vpe *vpe)
 
 static void its_vpe_teardown(struct its_vpe *vpe)
 {
+	/*
+	 * If vpt_page is NULL, then its_vpe_init() has failed, and
+	 * there is nothing to do as no resource has been allocated.
+	 */
+	if (!vpe->vpt_page)
+		return;
+
 	its_vpe_db_proxy_unmap(vpe);
 	its_vpe_id_free(vpe->vpe_id);
 	its_free_pending_table(vpe->vpt_page);

	M.

-- 
Without deviation from the norm, progress is not possible.

Re: [PATCH v5 0/4] Some Minor fixes and cleanups to irqchip/gic-v3-its

[Thomas Gleixner]

On Mon, Jul 20 2026 at 15:12, Kemeng Shi wrote:
>
> Kemeng Shi (4):
>   irqchip/gic-v3-its: Fix memleak in its_probe_one()
>   irqchip/gic-v3-its: Fix its node leak in gic_acpi_parse_madt_its()

Why are you resending already merged patches? You got an email
notification about it, no?

Re: [PATCH v5 4/4] irqchip/gic-v3-its: Fix grammar and replace a bit number with its symbol

[Radu Rendec]

On Mon, 2026-07-20 at 15:12 +0800, Kemeng Shi wrote:
> Fix grammatical errors in comments and simplify the comment about reading
> GITS_BASER_INDIRECT to check two-level support.
> 
> Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
> ---
>  drivers/irqchip/irq-gic-v3-its.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
> index 5dc91862fc15..8935a6e7a20f 100644
> --- a/drivers/irqchip/irq-gic-v3-its.c
> +++ b/drivers/irqchip/irq-gic-v3-its.c
> @@ -163,7 +163,7 @@ struct event_lpi_map {
>  
>  /*
>   * The ITS view of a device - belongs to an ITS, owns an interrupt
> - * translation table, and a list of interrupts.  If it some of its
> + * translation table, and a list of interrupts.  If some of its
>   * LPIs are injected into a guest (GICv4), the event_map.vm field
>   * indicates which one.
>   */
> @@ -2502,8 +2502,7 @@ static bool its_parse_indirect_baser(struct its_node *its,
>  	/* No need to enable Indirection if memory requirement < (psz*2)bytes */
>  	if ((esz << ids) > (psz * 2)) {
>  		/*
> -		 * Find out whether hw supports a single or two-level table by
> -		 * table by reading bit at offset '62' after writing '1' to it.
> +		 * Find out whether hw supports a single or two-level table
>  		 */

nit: since it's just one line of text now, you can put the /* */
comment markers on the same line, which is the preferred style for
single-line comments.

>  		its_write_baser(its, baser, val | GITS_BASER_INDIRECT);
>  		indirect = !!(baser->val & GITS_BASER_INDIRECT);

With that,

Reviewed-by: Radu Rendec <radu@rendec.net>

Re: [PATCH v5 3/4] irqchip/gic-v3-its: Fix leak in its_vpe_irq_domain_alloc()

[Kemeng Shi]

在 2026/7/20 16:50:00, Marc Zyngier 写道:
> On Mon, 20 Jul 2026 08:12:14 +0100,
> Kemeng Shi <shikemeng@huaweicloud.com> wrote:
>>
>> When its_irq_gic_domain_alloc() fails, the following
>> its_vpe_irq_domain_free() skips calling its_vep_teardown() for the
>> corresponding irq. Try its_vpe_teardown() in error handling to avoid
>> the leak issue.
>>
>> Fixes: 7d75bbb4bc1ad ("irqchip/gic-v3-its: Add VPE irq domain allocation/teardown")
>> Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
>> ---
>>  drivers/irqchip/irq-gic-v3-its.c | 12 ++++++++----
>>  1 file changed, 8 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
>> index 3e4edcb64065..5dc91862fc15 100644
>> --- a/drivers/irqchip/irq-gic-v3-its.c
>> +++ b/drivers/irqchip/irq-gic-v3-its.c
>> @@ -4594,9 +4594,11 @@ static int its_vpe_init(struct its_vpe *vpe)
>>  
>>  static void its_vpe_teardown(struct its_vpe *vpe)
>>  {
>> -	its_vpe_db_proxy_unmap(vpe);
>> -	its_vpe_id_free(vpe->vpe_id);
>> -	its_free_pending_table(vpe->vpt_page);
>> +	if (vpe->vpt_page != NULL) {
>> +		its_vpe_db_proxy_unmap(vpe);
>> +		its_vpe_id_free(vpe->vpe_id);
>> +		its_free_pending_table(vpe->vpt_page);
>> +	}
> 
> Please keep the diff minimal by doing an early return. This also
> deserves a comment, because this is not completely obvious:
Sure, I will do it in next version soon.> 
> diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
> index 6f5811aae59c1..38032067135b6 100644
> --- a/drivers/irqchip/irq-gic-v3-its.c
> +++ b/drivers/irqchip/irq-gic-v3-its.c
> @@ -4592,6 +4592,13 @@ static int its_vpe_init(struct its_vpe *vpe)
>  
>  static void its_vpe_teardown(struct its_vpe *vpe)
>  {
> +	/*
> +	 * If vpt_page is NULL, then its_vpe_init() has failed, and
> +	 * there is nothing to do as no resource has been allocated.
> +	 */
> +	if (!vpe->vpt_page)
> +		return;
> +
>  	its_vpe_db_proxy_unmap(vpe);
>  	its_vpe_id_free(vpe->vpe_id);
>  	its_free_pending_table(vpe->vpt_page);
> 
> 	M.
> 

Re: [PATCH v5 0/4] Some Minor fixes and cleanups to irqchip/gic-v3-its

[Kemeng Shi]

在 2026/7/21 2:46:30, Thomas Gleixner 写道:
> On Mon, Jul 20 2026 at 15:12, Kemeng Shi wrote:
>>
>> Kemeng Shi (4):
>>   irqchip/gic-v3-its: Fix memleak in its_probe_one()
>>   irqchip/gic-v3-its: Fix its node leak in gic_acpi_parse_madt_its()
> 
> Why are you resending already merged patches? You got an email
> notification about it, no?
Sorry for this.
I didn't see the notification before and still can't find the notification
by searching my mailbox.
I will drop these patches in next version and will check the tree before
sending a new patchset.

Re: [PATCH v5 4/4] irqchip/gic-v3-its: Fix grammar and replace a bit number with its symbol

[Kemeng Shi]

在 2026/7/21 8:58:52, Radu Rendec 写道:
> On Mon, 2026-07-20 at 15:12 +0800, Kemeng Shi wrote:
>> Fix grammatical errors in comments and simplify the comment about reading
>> GITS_BASER_INDIRECT to check two-level support.
>>
>> Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
>> ---
>>  drivers/irqchip/irq-gic-v3-its.c | 5 ++---
>>  1 file changed, 2 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
>> index 5dc91862fc15..8935a6e7a20f 100644
>> --- a/drivers/irqchip/irq-gic-v3-its.c
>> +++ b/drivers/irqchip/irq-gic-v3-its.c
>> @@ -163,7 +163,7 @@ struct event_lpi_map {
>>  
>>  /*
>>   * The ITS view of a device - belongs to an ITS, owns an interrupt
>> - * translation table, and a list of interrupts.  If it some of its
>> + * translation table, and a list of interrupts.  If some of its
>>   * LPIs are injected into a guest (GICv4), the event_map.vm field
>>   * indicates which one.
>>   */
>> @@ -2502,8 +2502,7 @@ static bool its_parse_indirect_baser(struct its_node *its,
>>  	/* No need to enable Indirection if memory requirement < (psz*2)bytes */
>>  	if ((esz << ids) > (psz * 2)) {
>>  		/*
>> -		 * Find out whether hw supports a single or two-level table by
>> -		 * table by reading bit at offset '62' after writing '1' to it.
>> +		 * Find out whether hw supports a single or two-level table
>>  		 */
> 
> nit: since it's just one line of text now, you can put the /* */
> comment markers on the same line, which is the preferred style for
> single-line comments.
Thanks for letting me know. I will improve this in the next version.> 
>>  		its_write_baser(its, baser, val | GITS_BASER_INDIRECT);
>>  		indirect = !!(baser->val & GITS_BASER_INDIRECT);
> 
> With that,
> 
> Reviewed-by: Radu Rendec <radu@rendec.net>