From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from m16.mail.163.com (m16.mail.163.com [117.135.210.2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4E8722E7BB6 for ; Fri, 12 Jun 2026 08:48:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=117.135.210.2 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781254116; cv=none; b=c5ZQvqftW05ZnZP1Etc9KMhJB/uXBgLeve+GBUrzChy6WR55Uf4Gd/jn7kk4KVN9xPRR0DAIQnS45QO7rm0JNyLYcblYkO6s7ZRdmk+jQNOifThPXgFFHWg2zi0HMdPNNdnJ6EVcL8lrywA1pWMdbaTVL0H4o2VGma4k+PKWvdc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781254116; c=relaxed/simple; bh=08Xq1WEk8Y8G0Mv9a7gSlbZdTdvfkXbNDEWCRpZUyD4=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=m271Tkx/AbRJpzXUw+Kl/4PhbF4Vco7BMuPGYlu7jZFnbi8hNWSF0E07j50Qqj9YdodeRyKCnonQpMg5qLInJiA8xD/15DQYwVo6FHMkIyc+ZwEBs01mCO5ACpXEsL7wVisYIsbPjN7dlOa/lNFISR2xW9QIkXeT0daVOymBmDQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=163.com; spf=pass smtp.mailfrom=163.com; dkim=pass (1024-bit key) header.d=163.com header.i=@163.com header.b=MT08WjRF; arc=none smtp.client-ip=117.135.210.2 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=163.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=163.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=163.com header.i=@163.com header.b="MT08WjRF" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:To:Subject:Date:Message-Id:MIME-Version; bh=Aj cMyVC3JzinC3DogJzC1QmKDmxzsp7n+sEOPZJAk2E=; b=MT08WjRFsXby6c7Y1m ew2fYVvRZrnRy+QtMem6IauSnyMLpdKRgRdfdxk0IE+sK2Q4Lu6WixBtcGlWCcJU xm660zRTzjOm6OmmM5GAU8Feo/wcgyDZQMdppClCa/wbqAq7tqf22SCOV+jOHAfD 8Ie0LNTVQTIy1yR/62r5sSH5A= Received: from localhost.localdomain (unknown []) by gzga-smtp-mtada-g1-2 (Coremail) with SMTP id _____wBHj+3Mxytq6gAbDA--.43730S2; Fri, 12 Jun 2026 16:48:12 +0800 (CST) From: fffsqian@163.com To: tglx@kernel.org, jhogan@kernel.org Cc: linux-kernel@vger.kernel.org, Qingshuang Fu Subject: [PATCH 1/1] irqchip/imgpdc: fix generic IRQ chip leak and missing chained handler cleanup on remove Date: Fri, 12 Jun 2026 16:47:45 +0800 Message-Id: <20260612084744.1219349-1-fffsqian@163.com> X-Mailer: git-send-email 2.25.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CM-TRANSID:_____wBHj+3Mxytq6gAbDA--.43730S2 X-Coremail-Antispam: 1Uf129KBjvJXoW7uw4xJFW8Zw1fKFyUuF4UJwb_yoW8uw1kpF WkG3sY9r4DKF10vF4xCF18ZFy2vw1rK3yUtas7K3ZIv3WUAw1q9FWFqF1UZ3y5CrW8Ka90 9rsrXay8ury5AaDanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07jbManUUUUU= X-CM-SenderInfo: 5iii21xldqqiywtou0bp/xtbC6gyKVWorx8z2-QAA34 From: Qingshuang Fu The driver allocates domain generic chips using irq_alloc_domain_generic_chips() during probe and sets up chained handlers using irq_set_chained_handler_and_data(). However, on driver remove, the generic chips are not freed and the chained handlers are not removed. The generic chips remain on the global gc_list and may later be visited by generic IRQ chip suspend, resume, or shutdown callbacks after the driver has been removed, potentially resulting in a use-after-free and kernel crash. The chained handlers that were installed in probe for peripheral and syswake IRQs are also left dangling, which can lead to spurious interrupts accessing freed memory. Fix by: - Adding irq_domain_remove_generic_chips() before irq_domain_remove() in both pdc_intc_remove() and the probe error path - Clearing all chained handlers with NULL in pdc_intc_remove() Fixes: b6ef9161e43a ("irq-imgpdc: add ImgTec PDC irqchip driver") Signed-off-by: Qingshuang Fu --- drivers/irqchip/irq-imgpdc.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/irqchip/irq-imgpdc.c b/drivers/irqchip/irq-imgpdc.c index e9ef2f5a7207..b5cf0beda245 100644 --- a/drivers/irqchip/irq-imgpdc.c +++ b/drivers/irqchip/irq-imgpdc.c @@ -457,6 +457,7 @@ static int pdc_intc_probe(struct platform_device *pdev) return 0; err_generic: + irq_domain_remove_generic_chips(priv->domain); irq_domain_remove(priv->domain); return ret; } @@ -464,7 +465,14 @@ static int pdc_intc_probe(struct platform_device *pdev) static void pdc_intc_remove(struct platform_device *pdev) { struct pdc_intc_priv *priv = platform_get_drvdata(pdev); + unsigned int i; + + for (i = 0; i < priv->nr_perips; ++i) + irq_set_chained_handler_and_data(priv->perip_irqs[i], NULL, NULL); + + irq_set_chained_handler_and_data(priv->syswake_irq, NULL, NULL); + irq_domain_remove_generic_chips(priv->domain); irq_domain_remove(priv->domain); } base-commit: 2b414a95b8f7307d42173ba9e580d6d3e2bcbfce -- 2.25.1