[PATCH v3 0/2] PCI: plda: Fix IRQ teardown and error-path resource leaks

[PATCH v3 0/2] PCI: plda: Fix IRQ teardown and error-path resource leaks

[Ali Tariq]

This series fixes two related IRQ-handling bugs in the PLDA PCIe
driver, both originally found by automated review from sashiko-bot
during work on an earlier, unrelated patch.

Patch 1 fixes a use-after-free: plda_pcie_irq_domain_deinit() removed
pcie->event_domain while devm-managed event IRQs requested from that
domain still had their free_irq() deferred by devres, so the deferred
cleanup could dereference an already-freed domain. It also hardens
the function so it is safe to call from partially-initialized state
(guards IRQ fields against being 0, and disposes of IRQ mappings
before their domains are torn down).

Patch 2 fixes resource leaks in plda_init_interrupts(): several error
paths returned directly without unwinding IRQ mappings or domains
already created earlier in the function. It adds shared error-handling
labels that call plda_pcie_irq_domain_deinit(), relying on the mapping
disposal added in patch 1.

Patch 2 depends on patch 1 and should not be applied on its own.

Both patches were build-tested and boot-tested on a StarFive
VisionFive v1.2A board.

Changes in v3:
- See individual patches for per-patch changes.

Ali Tariq (2):
  PCI: plda: Fix use-after-free of event IRQs during teardown
  PCI: plda: Fix resource leaks on error paths in plda_init_interrupts()

 drivers/pci/controller/plda/pcie-plda-host.c | 52 ++++++++++++++++----
 1 file changed, 42 insertions(+), 10 deletions(-)

-- 
2.34.1

[PATCH v3 1/2] PCI: plda: Fix use-after-free of event IRQs during teardown

[Ali Tariq]

plda_pcie_irq_domain_deinit() removes pcie->event_domain via
irq_domain_remove(), but the per-event IRQs mapped from that domain
are requested with devm_request_irq() in plda_init_interrupts(). The
actual free_irq() for a devm-managed IRQ is deferred by devres until
after the calling probe()/remove() function returns.

This means irq_domain_remove() can free the domain's internal data
before the deferred free_irq() for IRQs still mapped into it has run.
When devres later processes that deferred cleanup, it can end up
dereferencing the already-freed domain.

Free each event IRQ explicitly with devm_free_irq() before removing
the domain. This triggers the free immediately and removes the IRQ
from the devres tracking list, so devres will not attempt to free it
a second time later.

Also dispose of the event, INTx, and MSI IRQ mappings with
irq_dispose_mapping() before their owning domains are removed.

Finally, guard the calls to irq_set_chained_handler_and_data() for
pcie->irq, pcie->msi_irq, and pcie->intx_irq so they only run when
those fields hold a valid (>0) IRQ number.

This is a pre-existing issue, flagged by automated review during work
on an earlier, unrelated patch to this driver.

Build-tested and boot-tested on StarFive VisionFive v1.2A board

Fixes: 76c911396807 ("PCI: plda: Add host init/deinit and map bus functions")
Link: https://lore.kernel.org/linux-pci/20260714115343.4D49E1F000E9@smtp.kernel.org/
Signed-off-by: Ali Tariq <alitariq45892@gmail.com>
Cc: stable@vger.kernel.org
---
Changes in v3:
- First posting of this patch was v1 (single patch, no version tag).
  Jumping to v3 here to align versioning with patch 2/2, which has
  already been through v1 and v2.
- Guard irq_set_chained_handler_and_data() calls for pcie->irq,
  pcie->msi_irq, pcie->intx_irq with an IRQ > 0 check
- Dispose of event, INTx, and MSI IRQ mappings before their
  domains are removed
Link to v1: https://lore.kernel.org/linux-pci/20260718115022.231990-1-alitariq45892@gmail.com/
---
 drivers/pci/controller/plda/pcie-plda-host.c | 24 +++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/drivers/pci/controller/plda/pcie-plda-host.c b/drivers/pci/controller/plda/pcie-plda-host.c
index f9a34f323ad8..791f5c1cce06 100644
--- a/drivers/pci/controller/plda/pcie-plda-host.c
+++ b/drivers/pci/controller/plda/pcie-plda-host.c
@@ -559,9 +559,27 @@ EXPORT_SYMBOL_GPL(plda_pcie_setup_iomems);
 
 static void plda_pcie_irq_domain_deinit(struct plda_pcie_rp *pcie)
 {
-	irq_set_chained_handler_and_data(pcie->irq, NULL, NULL);
-	irq_set_chained_handler_and_data(pcie->msi_irq, NULL, NULL);
-	irq_set_chained_handler_and_data(pcie->intx_irq, NULL, NULL);
+	u32 i, event_irq;
+
+	if (pcie->irq > 0)
+		irq_set_chained_handler_and_data(pcie->irq, NULL, NULL);
+	if (pcie->msi_irq > 0)
+		irq_set_chained_handler_and_data(pcie->msi_irq, NULL, NULL);
+	if (pcie->intx_irq > 0)
+		irq_set_chained_handler_and_data(pcie->intx_irq, NULL, NULL);
+
+	for_each_set_bit(i, &pcie->events_bitmap, pcie->num_events) {
+		event_irq = irq_find_mapping(pcie->event_domain, i);
+		if (event_irq) {
+			devm_free_irq(pcie->dev, event_irq, pcie);
+			irq_dispose_mapping(event_irq);
+		}
+	}
+
+	if (pcie->intx_irq)
+		irq_dispose_mapping(pcie->intx_irq);
+	if (pcie->msi_irq)
+		irq_dispose_mapping(pcie->msi_irq);
 
 	irq_domain_remove(pcie->msi.dev_domain);
 
-- 
2.34.1

Re: [PATCH v3 0/2] PCI: plda: Fix IRQ teardown and error-path resource leaks

[Manivannan Sadhasivam]

On Thu, 23 Jul 2026 19:04:32 +0500, Ali Tariq wrote:
> This series fixes two related IRQ-handling bugs in the PLDA PCIe
> driver, both originally found by automated review from sashiko-bot
> during work on an earlier, unrelated patch.
> 
> Patch 1 fixes a use-after-free: plda_pcie_irq_domain_deinit() removed
> pcie->event_domain while devm-managed event IRQs requested from that
> domain still had their free_irq() deferred by devres, so the deferred
> cleanup could dereference an already-freed domain. It also hardens
> the function so it is safe to call from partially-initialized state
> (guards IRQ fields against being 0, and disposes of IRQ mappings
> before their domains are torn down).
> 
> [...]

Applied, thanks!

[1/2] PCI: plda: Fix use-after-free of event IRQs during teardown
      commit: 26b73bae01d6eb81a4a38f36101812f20b2639de

Best regards,
-- 
மணிவண்ணன் சதாசிவம்