The Linux Kernel Mailing List
 help / color / mirror / Atom feed
* [PATCH 1/1] irqchip/renesas-irqc: fix generic IRQ chip leak on remove
@ 2026-06-12  6:55 fffsqian
  2026-06-12  7:44 ` Geert Uytterhoeven
  0 siblings, 1 reply; 11+ messages in thread
From: fffsqian @ 2026-06-12  6:55 UTC (permalink / raw)
  To: maz, geert+renesas; +Cc: tglx, linux-kernel, Qingshuang Fu

From: Qingshuang Fu <fuqingshuang@kylinos.cn>

The driver allocates domain generic chips using
irq_alloc_domain_generic_chips() during probe. However, on driver
remove, the generic chips are not automatically freed when the IRQ
domain is removed because the domain flags do not include
IRQ_DOMAIN_FLAG_DESTROY_GC.

This causes both the domain generic chips structure and the associated
generic chips to be leaked. Additionally, the generic chips remain on
the global gc_list and may later be visited by generic IRQ chip suspend,
resume, or shutdown callbacks after the driver has been removed,
potentially resulting in a use-after-free and kernel crash.

Fix the resource leak by explicitly calling
irq_domain_remove_generic_chips() before removing the IRQ domain in
both irqc_remove() and the probe error path.

Fixes: 17c888920949 ("irqchip/renesas-irqc: Use proper irq_chip name and parent")
Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
---
 drivers/irqchip/irq-renesas-irqc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/irqchip/irq-renesas-irqc.c b/drivers/irqchip/irq-renesas-irqc.c
index a20a6471b0e4..a340d27dd8d7 100644
--- a/drivers/irqchip/irq-renesas-irqc.c
+++ b/drivers/irqchip/irq-renesas-irqc.c
@@ -211,6 +211,7 @@ static int irqc_probe(struct platform_device *pdev)
 	return 0;
 
 err_remove_domain:
+	irq_domain_remove_generic_chips(p->irq_domain);
 	irq_domain_remove(p->irq_domain);
 err_runtime_pm_disable:
 	pm_runtime_put(dev);
@@ -222,6 +223,7 @@ static void irqc_remove(struct platform_device *pdev)
 {
 	struct irqc_priv *p = platform_get_drvdata(pdev);
 
+	irq_domain_remove_generic_chips(p->irq_domain);
 	irq_domain_remove(p->irq_domain);
 	pm_runtime_put(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);

base-commit: 2b414a95b8f7307d42173ba9e580d6d3e2bcbfce
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 11+ messages in thread

* Re: [PATCH 1/1] irqchip/renesas-irqc: fix generic IRQ chip leak on remove
  2026-06-12  6:55 [PATCH 1/1] irqchip/renesas-irqc: fix generic IRQ chip leak on remove fffsqian
@ 2026-06-12  7:44 ` Geert Uytterhoeven
  2026-06-12  8:25   ` [PATCH v2 " fffsqian
                     ` (2 more replies)
  0 siblings, 3 replies; 11+ messages in thread
From: Geert Uytterhoeven @ 2026-06-12  7:44 UTC (permalink / raw)
  To: fffsqian; +Cc: maz, tglx, linux-kernel, Qingshuang Fu

Hi Qingshuang,

On Fri, 12 Jun 2026 at 08:55, <fffsqian@163.com> wrote:
> From: Qingshuang Fu <fuqingshuang@kylinos.cn>
>
> The driver allocates domain generic chips using
> irq_alloc_domain_generic_chips() during probe. However, on driver
> remove, the generic chips are not automatically freed when the IRQ
> domain is removed because the domain flags do not include
> IRQ_DOMAIN_FLAG_DESTROY_GC.
>
> This causes both the domain generic chips structure and the associated
> generic chips to be leaked. Additionally, the generic chips remain on
> the global gc_list and may later be visited by generic IRQ chip suspend,
> resume, or shutdown callbacks after the driver has been removed,
> potentially resulting in a use-after-free and kernel crash.
>
> Fix the resource leak by explicitly calling
> irq_domain_remove_generic_chips() before removing the IRQ domain in
> both irqc_remove() and the probe error path.

Thanks for your patch!

>
> Fixes: 17c888920949 ("irqchip/renesas-irqc: Use proper irq_chip name and parent")

Shouldn't that be

Fixes: 99c221df33fbfa1b ("irqchip/renesas-irqc: Move over to nested
generic chip")

?

> Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>

> --- a/drivers/irqchip/irq-renesas-irqc.c
> +++ b/drivers/irqchip/irq-renesas-irqc.c
> @@ -211,6 +211,7 @@ static int irqc_probe(struct platform_device *pdev)
>         return 0;
>
>  err_remove_domain:
> +       irq_domain_remove_generic_chips(p->irq_domain);

While I had expected a new label, this is indeed not needed, as
irq_domain_remove_generic_chips() is a no-op if irq_domain.gc
is NULL, which is the case if irq_domain_alloc_generic_chips() fails.

>         irq_domain_remove(p->irq_domain);
>  err_runtime_pm_disable:
>         pm_runtime_put(dev);

Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>

Gr{oetje,eeting}s,

                        Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds

^ permalink raw reply	[flat|nested] 11+ messages in thread

* [PATCH v2 1/1] irqchip/renesas-irqc: fix generic IRQ chip leak on remove
  2026-06-12  7:44 ` Geert Uytterhoeven
@ 2026-06-12  8:25   ` fffsqian
  2026-07-07  6:56   ` Re:Re: [PATCH " Qingshuang Fu
  2026-07-08  2:09   ` [PATCH v3 RESEND] " Qingshuang Fu
  2 siblings, 0 replies; 11+ messages in thread
From: fffsqian @ 2026-06-12  8:25 UTC (permalink / raw)
  To: maz, geert+renesas; +Cc: tglx, linux-kernel, Qingshuang Fu

Thanks for your careful review and correction.
Changes in v2:
- Corrected Fixes commit hash to 99c221df33fbfa1b, the commit that introduced nested generic chip allocation.
- Code remains unchanged; calling irq_domain_remove_generic_chips() unconditionally in the error path is safe per your feedback.

From: Qingshuang Fu <fuqingshuang@kylinos.cn>
Date: Fri, 12 Jun 2026 14:02:37 +0800
Subject: [PATCH v2 1/1] irqchip/renesas-irqc: fix generic IRQ chip leak on
 remove

The driver allocates domain generic chips using
irq_alloc_domain_generic_chips() during probe. However, on driver
remove, the generic chips are not automatically freed when the IRQ
domain is removed because the domain flags do not include
IRQ_DOMAIN_FLAG_DESTROY_GC.

This causes both the domain generic chips structure and the associated
generic chips to be leaked. Additionally, the generic chips remain on
the global gc_list and may later be visited by generic IRQ chip suspend,
resume, or shutdown callbacks after the driver has been removed,
potentially resulting in a use-after-free and kernel crash.

Fix the resource leak by explicitly calling
irq_domain_remove_generic_chips() before removing the IRQ domain in
both irqc_remove() and the probe error path.

Fixes: 99c221df33fbfa1b ("irqchip/renesas-irqc: Move over to nested generic chip")
Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
 drivers/irqchip/irq-renesas-irqc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/irqchip/irq-renesas-irqc.c b/drivers/irqchip/irq-renesas-irqc.c
index a20a6471b0e4..a340d27dd8d7 100644
--- a/drivers/irqchip/irq-renesas-irqc.c
+++ b/drivers/irqchip/irq-renesas-irqc.c
@@ -211,6 +211,7 @@ static int irqc_probe(struct platform_device *pdev)
 	return 0;
 
 err_remove_domain:
+	irq_domain_remove_generic_chips(p->irq_domain);
 	irq_domain_remove(p->irq_domain);
 err_runtime_pm_disable:
 	pm_runtime_put(dev);
@@ -222,6 +223,7 @@ static void irqc_remove(struct platform_device *pdev)
 {
 	struct irqc_priv *p = platform_get_drvdata(pdev);
 
+	irq_domain_remove_generic_chips(p->irq_domain);
 	irq_domain_remove(p->irq_domain);
 	pm_runtime_put(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);

base-commit: 2b414a95b8f7307d42173ba9e580d6d3e2bcbfce
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 11+ messages in thread

* Re:Re: [PATCH 1/1] irqchip/renesas-irqc: fix generic IRQ chip leak on remove
  2026-06-12  7:44 ` Geert Uytterhoeven
  2026-06-12  8:25   ` [PATCH v2 " fffsqian
@ 2026-07-07  6:56   ` Qingshuang Fu
  2026-07-07 19:41     ` Thomas Gleixner
  2026-07-08  2:09   ` [PATCH v3 RESEND] " Qingshuang Fu
  2 siblings, 1 reply; 11+ messages in thread
From: Qingshuang Fu @ 2026-07-07  6:56 UTC (permalink / raw)
  To: Geert Uytterhoeven; +Cc: maz, tglx, linux-kernel

At 2026-06-12 15:44:15, "Geert Uytterhoeven" <geert@linux-m68k.org> wrote:
>Hi Qingshuang,
>
>On Fri, 12 Jun 2026 at 08:55, <fffsqian@163.com> wrote:
>> From: Qingshuang Fu <fuqingshuang@kylinos.cn>
>>
>> The driver allocates domain generic chips using
>> irq_alloc_domain_generic_chips() during probe. However, on driver
>> remove, the generic chips are not automatically freed when the IRQ
>> domain is removed because the domain flags do not include
>> IRQ_DOMAIN_FLAG_DESTROY_GC.
>>
>> This causes both the domain generic chips structure and the associated
>> generic chips to be leaked. Additionally, the generic chips remain on
>> the global gc_list and may later be visited by generic IRQ chip suspend,
>> resume, or shutdown callbacks after the driver has been removed,
>> potentially resulting in a use-after-free and kernel crash.
>>
>> Fix the resource leak by explicitly calling
>> irq_domain_remove_generic_chips() before removing the IRQ domain in
>> both irqc_remove() and the probe error path.
>
>Thanks for your patch!
>
>>
>> Fixes: 17c888920949 ("irqchip/renesas-irqc: Use proper irq_chip name and parent")
>
>Shouldn't that be
>
>Fixes: 99c221df33fbfa1b ("irqchip/renesas-irqc: Move over to nested
>generic chip")
>
>?
>
>> Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
>
>> --- a/drivers/irqchip/irq-renesas-irqc.c
>> +++ b/drivers/irqchip/irq-renesas-irqc.c
>> @@ -211,6 +211,7 @@ static int irqc_probe(struct platform_device *pdev)
>>         return 0;
>>
>>  err_remove_domain:
>> +       irq_domain_remove_generic_chips(p->irq_domain);
>
>While I had expected a new label, this is indeed not needed, as
>irq_domain_remove_generic_chips() is a no-op if irq_domain.gc
>is NULL, which is the case if irq_domain_alloc_generic_chips() fails.
>
>>         irq_domain_remove(p->irq_domain);
>>  err_runtime_pm_disable:
>>         pm_runtime_put(dev);
>
>Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
>
>Gr{oetje,eeting}s,
>
>                        Geert
>
>-- 
>Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
>
>In personal conversations with technical people, I call myself a hacker. But
>when I'm talking to journalists I just say "programmer" or something like that.
>                                -- Linus Torvalds


Hi Geert,

Thanks a lot for your review and Reviewed-by tag.
I sent v2 patch one month ago, which corrected the wrong Fixes commit id as you suggested.

The patch adds missing irq_domain_remove_generic_chips() cleanup path in probe error handling, no functional breakage.
Could you help merge it when you have time?

v2 patch archive link:
https://lore.kernel.org/all/20260612082537.1212357-1-fffsqian@163.com/

Best regards,
Qingshuang Fu <fuqingshuang@kylinos.cn>
















^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re:Re: [PATCH 1/1] irqchip/renesas-irqc: fix generic IRQ chip leak on remove
  2026-07-07  6:56   ` Re:Re: [PATCH " Qingshuang Fu
@ 2026-07-07 19:41     ` Thomas Gleixner
  0 siblings, 0 replies; 11+ messages in thread
From: Thomas Gleixner @ 2026-07-07 19:41 UTC (permalink / raw)
  To: Qingshuang Fu, Geert Uytterhoeven; +Cc: maz, linux-kernel

On Tue, Jul 07 2026 at 14:56, Qingshuang Fu wrote:
> At 2026-06-12 15:44:15, "Geert Uytterhoeven" <geert@linux-m68k.org> wrote:
> The patch adds missing irq_domain_remove_generic_chips() cleanup path
> in probe error handling, no functional breakage.  Could you help merge
> it when you have time?

How about pinging the maintainer or resending the patch with [RESEND] in
the subject line?

That patch never made it into my inbox for whatever reasons, so it's not
a surprise that it is not merged.

Thanks,

        tglx


^ permalink raw reply	[flat|nested] 11+ messages in thread

* [PATCH v3 RESEND] irqchip/renesas-irqc: fix generic IRQ chip leak on remove
  2026-06-12  7:44 ` Geert Uytterhoeven
  2026-06-12  8:25   ` [PATCH v2 " fffsqian
  2026-07-07  6:56   ` Re:Re: [PATCH " Qingshuang Fu
@ 2026-07-08  2:09   ` Qingshuang Fu
  2026-07-08  9:02     ` Thomas Gleixner
  2 siblings, 1 reply; 11+ messages in thread
From: Qingshuang Fu @ 2026-07-08  2:09 UTC (permalink / raw)
  To: Thomas Gleixner, Magnus Damm, Geert Uytterhoeven, Marc Zyngier
  Cc: linux-kernel, linux-irqchip, linux-renesas-soc, Qingshuang Fu

From: Qingshuang Fu <fuqingshuang@kylinos.cn>

The driver allocates domain generic chips using
irq_alloc_domain_generic_chips() during probe. However, on driver
remove, the generic chips are not automatically freed when the IRQ
domain is removed because the domain flags do not include
IRQ_DOMAIN_FLAG_DESTROY_GC.

This causes both the domain generic chips structure and the associated
generic chips to be leaked. Additionally, the generic chips remain on
the global gc_list and may later be visited by generic IRQ chip suspend,
resume, or shutdown callbacks after the driver has been removed,
potentially resulting in a use-after-free and kernel crash.

Fix the resource leak by explicitly calling
irq_domain_remove_generic_chips() before removing the IRQ domain in
both irqc_remove() and the probe error path.

Fixes: 99c221df33fbfa1b ("irqchip/renesas-irqc: Move over to nested generic chip")
Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
 drivers/irqchip/irq-renesas-irqc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/irqchip/irq-renesas-irqc.c b/drivers/irqchip/irq-renesas-irqc.c
index a20a6471b0e4..a340d27dd8d7 100644
--- a/drivers/irqchip/irq-renesas-irqc.c
+++ b/drivers/irqchip/irq-renesas-irqc.c
@@ -211,6 +211,7 @@ static int irqc_probe(struct platform_device *pdev)
 	return 0;
 
 err_remove_domain:
+	irq_domain_remove_generic_chips(p->irq_domain);
 	irq_domain_remove(p->irq_domain);
 err_runtime_pm_disable:
 	pm_runtime_put(dev);
@@ -222,6 +223,7 @@ static void irqc_remove(struct platform_device *pdev)
 {
 	struct irqc_priv *p = platform_get_drvdata(pdev);
 
+	irq_domain_remove_generic_chips(p->irq_domain);
 	irq_domain_remove(p->irq_domain);
 	pm_runtime_put(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);

base-commit: 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 11+ messages in thread

* Re: [PATCH v3 RESEND] irqchip/renesas-irqc: fix generic IRQ chip leak on remove
  2026-07-08  2:09   ` [PATCH v3 RESEND] " Qingshuang Fu
@ 2026-07-08  9:02     ` Thomas Gleixner
  2026-07-08  9:38       ` [PATCH v4] irqchip/renesas-irqc: fix generic interrupt " Qingshuang Fu
  0 siblings, 1 reply; 11+ messages in thread
From: Thomas Gleixner @ 2026-07-08  9:02 UTC (permalink / raw)
  To: Qingshuang Fu, Magnus Damm, Geert Uytterhoeven, Marc Zyngier
  Cc: linux-kernel, linux-irqchip, linux-renesas-soc, Qingshuang Fu

On Wed, Jul 08 2026 at 10:09, Qingshuang Fu wrote:

Please use 'interrupts' and not 'IRQ'. This is prose text and not twitter.

> diff --git a/drivers/irqchip/irq-renesas-irqc.c b/drivers/irqchip/irq-renesas-irqc.c
> index a20a6471b0e4..a340d27dd8d7 100644
> --- a/drivers/irqchip/irq-renesas-irqc.c
> +++ b/drivers/irqchip/irq-renesas-irqc.c
> @@ -211,6 +211,7 @@ static int irqc_probe(struct platform_device *pdev)
>  	return 0;

>  err_remove_domain:
> +	irq_domain_remove_generic_chips(p->irq_domain);
>  	irq_domain_remove(p->irq_domain);
>  err_runtime_pm_disable:
>  	pm_runtime_put(dev);
> @@ -222,6 +223,7 @@ static void irqc_remove(struct platform_device *pdev)
>  {
>  	struct irqc_priv *p = platform_get_drvdata(pdev);
>  
> +	irq_domain_remove_generic_chips(p->irq_domain);
>  	irq_domain_remove(p->irq_domain);
>  	pm_runtime_put(&pdev->dev);
>  	pm_runtime_disable(&pdev->dev);

That can be simplified by doing:

     p->irq_domain->flags |= IRQ_DOMAIN_FLAG_DESTROY_GC

Thanks,

        tglx

^ permalink raw reply	[flat|nested] 11+ messages in thread

* [PATCH v4] irqchip/renesas-irqc: fix generic interrupt chip leak on remove
  2026-07-08  9:02     ` Thomas Gleixner
@ 2026-07-08  9:38       ` Qingshuang Fu
  2026-07-08  9:48         ` Geert Uytterhoeven
  0 siblings, 1 reply; 11+ messages in thread
From: Qingshuang Fu @ 2026-07-08  9:38 UTC (permalink / raw)
  To: Thomas Gleixner, Magnus Damm, Geert Uytterhoeven, Marc Zyngier
  Cc: linux-kernel, linux-renesas-soc, Qingshuang Fu, Qingshuang Fu

From: Qingshuang Fu <fuqingshuang@kylinos.cn>

The driver allocates domain generic chips using
irq_alloc_domain_generic_chips() during probe. However, on driver
remove, the generic chips are not automatically freed when the interrupt
domain is removed because the domain flags do not include
IRQ_DOMAIN_FLAG_DESTROY_GC.

This causes both the domain generic chips structure and the associated
generic chips to be leaked. Additionally, the generic chips remain on
the global gc_list and may later be visited by generic interrupt chip
suspend, resume, or shutdown callbacks after the driver has been removed,
potentially resulting in a use-after-free and kernel crash.

Fix the resource leak by setting IRQ_DOMAIN_FLAG_DESTROY_GC on the
interrupt domain; this lets the interrupt domain core automatically
release all generic chips when irq_domain_remove() is called, removing
the need for manual cleanup calls in error paths and remove callback.

Fixes: 99c221df33fbfa1b ("irqchip/renesas-irqc: Move over to nested generic chip")
Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
 drivers/irqchip/irq-renesas-irqc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-renesas-irqc.c b/drivers/irqchip/irq-renesas-irqc.c
index a20a6471b0e4..4b8b86c89b6a 100644
--- a/drivers/irqchip/irq-renesas-irqc.c
+++ b/drivers/irqchip/irq-renesas-irqc.c
@@ -194,6 +194,9 @@ static int irqc_probe(struct platform_device *pdev)
 	p->gc->chip_types[0].chip.irq_set_wake	= irqc_irq_set_wake;
 	p->gc->chip_types[0].chip.flags	= IRQCHIP_MASK_ON_SUSPEND;
 
+	/* Automatically free generic chips when interrupt domain is destroyed */
+	p->irq_domain->flags |= IRQ_DOMAIN_FLAG_DESTROY_GC;
+
 	irq_domain_set_pm_device(p->irq_domain, dev);
 
 	/* request interrupts one by one */

base-commit: 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 11+ messages in thread

* Re: [PATCH v4] irqchip/renesas-irqc: fix generic interrupt chip leak on remove
  2026-07-08  9:38       ` [PATCH v4] irqchip/renesas-irqc: fix generic interrupt " Qingshuang Fu
@ 2026-07-08  9:48         ` Geert Uytterhoeven
  2026-07-08 10:08           ` [PATCH v5] " Qingshuang Fu
  2026-07-08 10:10           ` Re:Re: [PATCH v4] " Qingshuang Fu
  0 siblings, 2 replies; 11+ messages in thread
From: Geert Uytterhoeven @ 2026-07-08  9:48 UTC (permalink / raw)
  To: Qingshuang Fu
  Cc: Thomas Gleixner, Magnus Damm, Marc Zyngier, linux-kernel,
	linux-renesas-soc, Qingshuang Fu

Hi Qingshuang,

On Wed, 8 Jul 2026 at 11:39, Qingshuang Fu <fffsqian@163.com> wrote:
> From: Qingshuang Fu <fuqingshuang@kylinos.cn>
>
> The driver allocates domain generic chips using
> irq_alloc_domain_generic_chips() during probe. However, on driver
> remove, the generic chips are not automatically freed when the interrupt
> domain is removed because the domain flags do not include
> IRQ_DOMAIN_FLAG_DESTROY_GC.
>
> This causes both the domain generic chips structure and the associated
> generic chips to be leaked. Additionally, the generic chips remain on
> the global gc_list and may later be visited by generic interrupt chip
> suspend, resume, or shutdown callbacks after the driver has been removed,
> potentially resulting in a use-after-free and kernel crash.
>
> Fix the resource leak by setting IRQ_DOMAIN_FLAG_DESTROY_GC on the
> interrupt domain; this lets the interrupt domain core automatically
> release all generic chips when irq_domain_remove() is called, removing
> the need for manual cleanup calls in error paths and remove callback.
>
> Fixes: 99c221df33fbfa1b ("irqchip/renesas-irqc: Move over to nested generic chip")

Thanks for the update!
No changelog?

> Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>

Please do not retain Rb-tags when completely changing a patch.

> --- a/drivers/irqchip/irq-renesas-irqc.c
> +++ b/drivers/irqchip/irq-renesas-irqc.c
> @@ -194,6 +194,9 @@ static int irqc_probe(struct platform_device *pdev)
>         p->gc->chip_types[0].chip.irq_set_wake  = irqc_irq_set_wake;
>         p->gc->chip_types[0].chip.flags = IRQCHIP_MASK_ON_SUSPEND;
>
> +       /* Automatically free generic chips when interrupt domain is destroyed */

I am not sure you need the comment.

> +       p->irq_domain->flags |= IRQ_DOMAIN_FLAG_DESTROY_GC;
> +

LGTM, but you may want to do this right after creating p->irq_domain,
like is done in pdc_intc_probe().

>         irq_domain_set_pm_device(p->irq_domain, dev);
>
>         /* request interrupts one by one */
>

Gr{oetje,eeting}s,

                        Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds

^ permalink raw reply	[flat|nested] 11+ messages in thread

* [PATCH v5] irqchip/renesas-irqc: fix generic interrupt chip leak on remove
  2026-07-08  9:48         ` Geert Uytterhoeven
@ 2026-07-08 10:08           ` Qingshuang Fu
  2026-07-08 10:10           ` Re:Re: [PATCH v4] " Qingshuang Fu
  1 sibling, 0 replies; 11+ messages in thread
From: Qingshuang Fu @ 2026-07-08 10:08 UTC (permalink / raw)
  To: Thomas Gleixner, Magnus Damm, Geert Uytterhoeven, Marc Zyngier
  Cc: linux-kernel, linux-renesas-soc, Qingshuang Fu, Qingshuang Fu

From: Qingshuang Fu <fuqingshuang@kylinos.cn>

The driver allocates domain generic chips using
irq_alloc_domain_generic_chips() during probe. However, on driver
remove, the generic chips are not automatically freed when the interrupt
domain is removed because the domain flags do not include
IRQ_DOMAIN_FLAG_DESTROY_GC.

This causes both the domain generic chips structure and the associated
generic chips to be leaked. Additionally, the generic chips remain on
the global gc_list and may later be visited by generic interrupt chip
suspend, resume, or shutdown callbacks after the driver has been removed,
potentially resulting in a use-after-free and kernel crash.

Fix the resource leak by setting IRQ_DOMAIN_FLAG_DESTROY_GC on the
interrupt domain; this lets the interrupt domain core automatically
release all generic chips when irq_domain_remove() is called, removing
the need for manual cleanup calls in error paths and remove callback.

Fixes: 99c221df33fbfa1b ("irqchip/renesas-irqc: Move over to nested generic chip")
Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
---
Changes from v1 to v2:
- Corrected wrong Fixes commit ID per Geert's review

Changes from v2 to v3:
- Reword commit prose to use full "interrupt" instead of shorthand "IRQ"
- Add manual irq_domain_remove_generic_chips() cleanup in probe error path and remove callback to fix leak

Changes from v3 to v4:
- Adopt tglx's suggestion: set IRQ_DOMAIN_FLAG_DESTROY_GC instead of manual
  irq_domain_remove_generic_chips() cleanup calls

Changes from v4 to v5:
1. Move IRQ_DOMAIN_FLAG_DESTROY_GC assignment right after irq_domain creation
   to align with similar drivers like pdc_intc_probe()
2. Drop redundant comment for flag assignment
3. Remove old Reviewed-by tag since the implementation logic was fully changed

 drivers/irqchip/irq-renesas-irqc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/irqchip/irq-renesas-irqc.c b/drivers/irqchip/irq-renesas-irqc.c
index a20a6471b0e4..1ff3535a4617 100644
--- a/drivers/irqchip/irq-renesas-irqc.c
+++ b/drivers/irqchip/irq-renesas-irqc.c
@@ -176,6 +176,7 @@ static int irqc_probe(struct platform_device *pdev)
 		goto err_runtime_pm_disable;
 	}
 
+	p->irq_domain->flags |= IRQ_DOMAIN_FLAG_DESTROY_GC;
 	ret = irq_alloc_domain_generic_chips(p->irq_domain, p->number_of_irqs,
 					     1, "irqc", handle_level_irq,
 					     0, 0, IRQ_GC_INIT_NESTED_LOCK);

base-commit: 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 11+ messages in thread

* Re:Re: [PATCH v4] irqchip/renesas-irqc: fix generic interrupt chip leak on remove
  2026-07-08  9:48         ` Geert Uytterhoeven
  2026-07-08 10:08           ` [PATCH v5] " Qingshuang Fu
@ 2026-07-08 10:10           ` Qingshuang Fu
  1 sibling, 0 replies; 11+ messages in thread
From: Qingshuang Fu @ 2026-07-08 10:10 UTC (permalink / raw)
  To: Geert Uytterhoeven
  Cc: Thomas Gleixner, Magnus Damm, Marc Zyngier, linux-kernel,
	linux-renesas-soc

At 2026-07-08 17:48:07, "Geert Uytterhoeven" <geert@linux-m68k.org> wrote:
>Hi Qingshuang,
>
>On Wed, 8 Jul 2026 at 11:39, Qingshuang Fu <fffsqian@163.com> wrote:
>> From: Qingshuang Fu <fuqingshuang@kylinos.cn>
>>
>> The driver allocates domain generic chips using
>> irq_alloc_domain_generic_chips() during probe. However, on driver
>> remove, the generic chips are not automatically freed when the interrupt
>> domain is removed because the domain flags do not include
>> IRQ_DOMAIN_FLAG_DESTROY_GC.
>>
>> This causes both the domain generic chips structure and the associated
>> generic chips to be leaked. Additionally, the generic chips remain on
>> the global gc_list and may later be visited by generic interrupt chip
>> suspend, resume, or shutdown callbacks after the driver has been removed,
>> potentially resulting in a use-after-free and kernel crash.
>>
>> Fix the resource leak by setting IRQ_DOMAIN_FLAG_DESTROY_GC on the
>> interrupt domain; this lets the interrupt domain core automatically
>> release all generic chips when irq_domain_remove() is called, removing
>> the need for manual cleanup calls in error paths and remove callback.
>>
>> Fixes: 99c221df33fbfa1b ("irqchip/renesas-irqc: Move over to nested generic chip")
>
>Thanks for the update!
>No changelog?
>
>> Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
>> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
>
>Please do not retain Rb-tags when completely changing a patch.
>
>> --- a/drivers/irqchip/irq-renesas-irqc.c
>> +++ b/drivers/irqchip/irq-renesas-irqc.c
>> @@ -194,6 +194,9 @@ static int irqc_probe(struct platform_device *pdev)
>>         p->gc->chip_types[0].chip.irq_set_wake  = irqc_irq_set_wake;
>>         p->gc->chip_types[0].chip.flags = IRQCHIP_MASK_ON_SUSPEND;
>>
>> +       /* Automatically free generic chips when interrupt domain is destroyed */
>
>I am not sure you need the comment.
>
>> +       p->irq_domain->flags |= IRQ_DOMAIN_FLAG_DESTROY_GC;
>> +
>
>LGTM, but you may want to do this right after creating p->irq_domain,
>like is done in pdc_intc_probe().
>
>>         irq_domain_set_pm_device(p->irq_domain, dev);
>>
>>         /* request interrupts one by one */
>>
>
>Gr{oetje,eeting}s,
>
>                        Geert
>
>-- 
>Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
>
>In personal conversations with technical people, I call myself a hacker. But
>when I'm talking to journalists I just say "programmer" or something like that.
>                                -- Linus Torvalds


Hi Geert,

Thanks for your review. I've updated the patch to v5 as your suggestions:
1. Added full version changelog under split line.
2. Moved IRQ_DOMAIN_FLAG_DESTROY_GC assignment right after irq_domain creation.
3. Removed redundant comment and dropped old Reviewed-by tag as implementation fully changed.

v5 patch attached.

Qingshuang Fu


^ permalink raw reply	[flat|nested] 11+ messages in thread

end of thread, other threads:[~2026-07-08 10:10 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-12  6:55 [PATCH 1/1] irqchip/renesas-irqc: fix generic IRQ chip leak on remove fffsqian
2026-06-12  7:44 ` Geert Uytterhoeven
2026-06-12  8:25   ` [PATCH v2 " fffsqian
2026-07-07  6:56   ` Re:Re: [PATCH " Qingshuang Fu
2026-07-07 19:41     ` Thomas Gleixner
2026-07-08  2:09   ` [PATCH v3 RESEND] " Qingshuang Fu
2026-07-08  9:02     ` Thomas Gleixner
2026-07-08  9:38       ` [PATCH v4] irqchip/renesas-irqc: fix generic interrupt " Qingshuang Fu
2026-07-08  9:48         ` Geert Uytterhoeven
2026-07-08 10:08           ` [PATCH v5] " Qingshuang Fu
2026-07-08 10:10           ` Re:Re: [PATCH v4] " Qingshuang Fu

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox