The Linux Kernel Mailing List
 help / color / mirror / Atom feed
* [PATCH 1/1] irqchip/renesas-irqc: fix generic IRQ chip leak on remove
@ 2026-06-12  6:55 fffsqian
  2026-06-12  7:44 ` Geert Uytterhoeven
  0 siblings, 1 reply; 11+ messages in thread
From: fffsqian @ 2026-06-12  6:55 UTC (permalink / raw)
  To: maz, geert+renesas; +Cc: tglx, linux-kernel, Qingshuang Fu

From: Qingshuang Fu <fuqingshuang@kylinos.cn>

The driver allocates domain generic chips using
irq_alloc_domain_generic_chips() during probe. However, on driver
remove, the generic chips are not automatically freed when the IRQ
domain is removed because the domain flags do not include
IRQ_DOMAIN_FLAG_DESTROY_GC.

This causes both the domain generic chips structure and the associated
generic chips to be leaked. Additionally, the generic chips remain on
the global gc_list and may later be visited by generic IRQ chip suspend,
resume, or shutdown callbacks after the driver has been removed,
potentially resulting in a use-after-free and kernel crash.

Fix the resource leak by explicitly calling
irq_domain_remove_generic_chips() before removing the IRQ domain in
both irqc_remove() and the probe error path.

Fixes: 17c888920949 ("irqchip/renesas-irqc: Use proper irq_chip name and parent")
Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
---
 drivers/irqchip/irq-renesas-irqc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/irqchip/irq-renesas-irqc.c b/drivers/irqchip/irq-renesas-irqc.c
index a20a6471b0e4..a340d27dd8d7 100644
--- a/drivers/irqchip/irq-renesas-irqc.c
+++ b/drivers/irqchip/irq-renesas-irqc.c
@@ -211,6 +211,7 @@ static int irqc_probe(struct platform_device *pdev)
 	return 0;
 
 err_remove_domain:
+	irq_domain_remove_generic_chips(p->irq_domain);
 	irq_domain_remove(p->irq_domain);
 err_runtime_pm_disable:
 	pm_runtime_put(dev);
@@ -222,6 +223,7 @@ static void irqc_remove(struct platform_device *pdev)
 {
 	struct irqc_priv *p = platform_get_drvdata(pdev);
 
+	irq_domain_remove_generic_chips(p->irq_domain);
 	irq_domain_remove(p->irq_domain);
 	pm_runtime_put(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);

base-commit: 2b414a95b8f7307d42173ba9e580d6d3e2bcbfce
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 11+ messages in thread

end of thread, other threads:[~2026-07-08 10:10 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-12  6:55 [PATCH 1/1] irqchip/renesas-irqc: fix generic IRQ chip leak on remove fffsqian
2026-06-12  7:44 ` Geert Uytterhoeven
2026-06-12  8:25   ` [PATCH v2 " fffsqian
2026-07-07  6:56   ` Re:Re: [PATCH " Qingshuang Fu
2026-07-07 19:41     ` Thomas Gleixner
2026-07-08  2:09   ` [PATCH v3 RESEND] " Qingshuang Fu
2026-07-08  9:02     ` Thomas Gleixner
2026-07-08  9:38       ` [PATCH v4] irqchip/renesas-irqc: fix generic interrupt " Qingshuang Fu
2026-07-08  9:48         ` Geert Uytterhoeven
2026-07-08 10:08           ` [PATCH v5] " Qingshuang Fu
2026-07-08 10:10           ` Re:Re: [PATCH v4] " Qingshuang Fu

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox