Re: [PATCH v3 1/3] irqdomain: Set IRQ_DOMAIN_FLAG_DESTROY_GC in __irq_domain_instantiate()

[Herve Codina <herve.codina@bootlin.com>]

Hi Qingshuang,

On Mon,  7 Sep 2026 10:40:44 +0800
Qingshuang Fu <fuqingshuang@kylinos.cn> wrote:

> When a driver uses irq_domain_instantiate() with dgc_info to create
> generic irq chips, IRQ_DOMAIN_FLAG_DESTROY_GC is required so that
> irq_domain_remove() can clean up those generic chips.
> 
> All existing in-tree callers manually set this flag today, but this
> pattern is error-prone. A future new caller forgetting to set the flag
> would leave generic chips allocated by irq_domain_alloc_generic_chips()
> leaked on domain removal.
> 
> Set IRQ_DOMAIN_FLAG_DESTROY_GC right after
> irq_domain_alloc_generic_chips() succeeds inside
> __irq_domain_instantiate().  This makes automatic cleanup the default
> for all users that provide dgc_info via irq_domain_instantiate().
> 
> This is the correct location for the flag because:
> 
>   - irq_domain_instantiate() is a high-level wrapper which internally
>     allocates the generic chips, so it should also take responsibility
>     for arranging their cleanup.
> 
>   - Setting the flag in irq_domain_alloc_generic_chips() would affect
>     legacy callers like __irq_alloc_domain_generic_chips(), some of
>     which have custom cleanup paths that manually free the generic
>     chips (e.g. gpio-tb10x does kfree(domain->gc) before
>     irq_domain_remove()), leading to use-after-free.
> 
> Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
> ---
>  kernel/irq/irqdomain.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
> index 57c819da30c2..4fdcb6df5306 100644
> --- a/kernel/irq/irqdomain.c
> +++ b/kernel/irq/irqdomain.c
> @@ -344,6 +344,7 @@ static struct irq_domain *__irq_domain_instantiate(const struct irq_domain_info
>  		err = irq_domain_alloc_generic_chips(domain, info->dgc_info);
>  		if (err)
>  			goto err_domain_free;
> +		domain->flags |= IRQ_DOMAIN_FLAG_DESTROY_GC;
>  	}
>  
>  	if (info->init) {

LGTM.

Reviewed-by: Herve Codina <herve.codina@bootlin.com>

Best regards,
Hervé