[PATCH 1/1] irqchip/renesas-irqc: fix generic IRQ chip leak on remove

[PATCH 1/1] irqchip/renesas-irqc: fix generic IRQ chip leak on remove

[fffsqian]

From: Qingshuang Fu <fuqingshuang@kylinos.cn>

The driver allocates domain generic chips using
irq_alloc_domain_generic_chips() during probe. However, on driver
remove, the generic chips are not automatically freed when the IRQ
domain is removed because the domain flags do not include
IRQ_DOMAIN_FLAG_DESTROY_GC.

This causes both the domain generic chips structure and the associated
generic chips to be leaked. Additionally, the generic chips remain on
the global gc_list and may later be visited by generic IRQ chip suspend,
resume, or shutdown callbacks after the driver has been removed,
potentially resulting in a use-after-free and kernel crash.

Fix the resource leak by explicitly calling
irq_domain_remove_generic_chips() before removing the IRQ domain in
both irqc_remove() and the probe error path.

Fixes: 17c888920949 ("irqchip/renesas-irqc: Use proper irq_chip name and parent")
Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
---
 drivers/irqchip/irq-renesas-irqc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/irqchip/irq-renesas-irqc.c b/drivers/irqchip/irq-renesas-irqc.c
index a20a6471b0e4..a340d27dd8d7 100644
--- a/drivers/irqchip/irq-renesas-irqc.c
+++ b/drivers/irqchip/irq-renesas-irqc.c
@@ -211,6 +211,7 @@ static int irqc_probe(struct platform_device *pdev)
 	return 0;
 
 err_remove_domain:
+	irq_domain_remove_generic_chips(p->irq_domain);
 	irq_domain_remove(p->irq_domain);
 err_runtime_pm_disable:
 	pm_runtime_put(dev);
@@ -222,6 +223,7 @@ static void irqc_remove(struct platform_device *pdev)
 {
 	struct irqc_priv *p = platform_get_drvdata(pdev);
 
+	irq_domain_remove_generic_chips(p->irq_domain);
 	irq_domain_remove(p->irq_domain);
 	pm_runtime_put(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);

base-commit: 2b414a95b8f7307d42173ba9e580d6d3e2bcbfce
-- 
2.25.1

Re: [PATCH 1/1] irqchip/renesas-irqc: fix generic IRQ chip leak on remove

[Geert Uytterhoeven]

Hi Qingshuang,

On Fri, 12 Jun 2026 at 08:55, <fffsqian@163.com> wrote:
> From: Qingshuang Fu <fuqingshuang@kylinos.cn>
>
> The driver allocates domain generic chips using
> irq_alloc_domain_generic_chips() during probe. However, on driver
> remove, the generic chips are not automatically freed when the IRQ
> domain is removed because the domain flags do not include
> IRQ_DOMAIN_FLAG_DESTROY_GC.
>
> This causes both the domain generic chips structure and the associated
> generic chips to be leaked. Additionally, the generic chips remain on
> the global gc_list and may later be visited by generic IRQ chip suspend,
> resume, or shutdown callbacks after the driver has been removed,
> potentially resulting in a use-after-free and kernel crash.
>
> Fix the resource leak by explicitly calling
> irq_domain_remove_generic_chips() before removing the IRQ domain in
> both irqc_remove() and the probe error path.

Thanks for your patch!

>
> Fixes: 17c888920949 ("irqchip/renesas-irqc: Use proper irq_chip name and parent")

Shouldn't that be

Fixes: 99c221df33fbfa1b ("irqchip/renesas-irqc: Move over to nested
generic chip")

?

> Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>

> --- a/drivers/irqchip/irq-renesas-irqc.c
> +++ b/drivers/irqchip/irq-renesas-irqc.c
> @@ -211,6 +211,7 @@ static int irqc_probe(struct platform_device *pdev)
>         return 0;
>
>  err_remove_domain:
> +       irq_domain_remove_generic_chips(p->irq_domain);

While I had expected a new label, this is indeed not needed, as
irq_domain_remove_generic_chips() is a no-op if irq_domain.gc
is NULL, which is the case if irq_domain_alloc_generic_chips() fails.

>         irq_domain_remove(p->irq_domain);
>  err_runtime_pm_disable:
>         pm_runtime_put(dev);

Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>

Gr{oetje,eeting}s,

                        Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds

[PATCH v2 1/1] irqchip/renesas-irqc: fix generic IRQ chip leak on remove

[fffsqian]

Thanks for your careful review and correction.
Changes in v2:
- Corrected Fixes commit hash to 99c221df33fbfa1b, the commit that introduced nested generic chip allocation.
- Code remains unchanged; calling irq_domain_remove_generic_chips() unconditionally in the error path is safe per your feedback.

From: Qingshuang Fu <fuqingshuang@kylinos.cn>
Date: Fri, 12 Jun 2026 14:02:37 +0800
Subject: [PATCH v2 1/1] irqchip/renesas-irqc: fix generic IRQ chip leak on
 remove

The driver allocates domain generic chips using
irq_alloc_domain_generic_chips() during probe. However, on driver
remove, the generic chips are not automatically freed when the IRQ
domain is removed because the domain flags do not include
IRQ_DOMAIN_FLAG_DESTROY_GC.

This causes both the domain generic chips structure and the associated
generic chips to be leaked. Additionally, the generic chips remain on
the global gc_list and may later be visited by generic IRQ chip suspend,
resume, or shutdown callbacks after the driver has been removed,
potentially resulting in a use-after-free and kernel crash.

Fix the resource leak by explicitly calling
irq_domain_remove_generic_chips() before removing the IRQ domain in
both irqc_remove() and the probe error path.

Fixes: 99c221df33fbfa1b ("irqchip/renesas-irqc: Move over to nested generic chip")
Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
 drivers/irqchip/irq-renesas-irqc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/irqchip/irq-renesas-irqc.c b/drivers/irqchip/irq-renesas-irqc.c
index a20a6471b0e4..a340d27dd8d7 100644
--- a/drivers/irqchip/irq-renesas-irqc.c
+++ b/drivers/irqchip/irq-renesas-irqc.c
@@ -211,6 +211,7 @@ static int irqc_probe(struct platform_device *pdev)
 	return 0;
 
 err_remove_domain:
+	irq_domain_remove_generic_chips(p->irq_domain);
 	irq_domain_remove(p->irq_domain);
 err_runtime_pm_disable:
 	pm_runtime_put(dev);
@@ -222,6 +223,7 @@ static void irqc_remove(struct platform_device *pdev)
 {
 	struct irqc_priv *p = platform_get_drvdata(pdev);
 
+	irq_domain_remove_generic_chips(p->irq_domain);
 	irq_domain_remove(p->irq_domain);
 	pm_runtime_put(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);

base-commit: 2b414a95b8f7307d42173ba9e580d6d3e2bcbfce
-- 
2.25.1

Re:Re: [PATCH 1/1] irqchip/renesas-irqc: fix generic IRQ chip leak on remove

[Qingshuang Fu]

At 2026-06-12 15:44:15, "Geert Uytterhoeven" <geert@linux-m68k.org> wrote:
>Hi Qingshuang,
>
>On Fri, 12 Jun 2026 at 08:55, <fffsqian@163.com> wrote:
>> From: Qingshuang Fu <fuqingshuang@kylinos.cn>
>>
>> The driver allocates domain generic chips using
>> irq_alloc_domain_generic_chips() during probe. However, on driver
>> remove, the generic chips are not automatically freed when the IRQ
>> domain is removed because the domain flags do not include
>> IRQ_DOMAIN_FLAG_DESTROY_GC.
>>
>> This causes both the domain generic chips structure and the associated
>> generic chips to be leaked. Additionally, the generic chips remain on
>> the global gc_list and may later be visited by generic IRQ chip suspend,
>> resume, or shutdown callbacks after the driver has been removed,
>> potentially resulting in a use-after-free and kernel crash.
>>
>> Fix the resource leak by explicitly calling
>> irq_domain_remove_generic_chips() before removing the IRQ domain in
>> both irqc_remove() and the probe error path.
>
>Thanks for your patch!
>
>>
>> Fixes: 17c888920949 ("irqchip/renesas-irqc: Use proper irq_chip name and parent")
>
>Shouldn't that be
>
>Fixes: 99c221df33fbfa1b ("irqchip/renesas-irqc: Move over to nested
>generic chip")
>
>?
>
>> Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
>
>> --- a/drivers/irqchip/irq-renesas-irqc.c
>> +++ b/drivers/irqchip/irq-renesas-irqc.c
>> @@ -211,6 +211,7 @@ static int irqc_probe(struct platform_device *pdev)
>>         return 0;
>>
>>  err_remove_domain:
>> +       irq_domain_remove_generic_chips(p->irq_domain);
>
>While I had expected a new label, this is indeed not needed, as
>irq_domain_remove_generic_chips() is a no-op if irq_domain.gc
>is NULL, which is the case if irq_domain_alloc_generic_chips() fails.
>
>>         irq_domain_remove(p->irq_domain);
>>  err_runtime_pm_disable:
>>         pm_runtime_put(dev);
>
>Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
>
>Gr{oetje,eeting}s,
>
>                        Geert
>
>-- 
>Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
>
>In personal conversations with technical people, I call myself a hacker. But
>when I'm talking to journalists I just say "programmer" or something like that.
>                                -- Linus Torvalds


Hi Geert,

Thanks a lot for your review and Reviewed-by tag.
I sent v2 patch one month ago, which corrected the wrong Fixes commit id as you suggested.

The patch adds missing irq_domain_remove_generic_chips() cleanup path in probe error handling, no functional breakage.
Could you help merge it when you have time?

v2 patch archive link:
https://lore.kernel.org/all/20260612082537.1212357-1-fffsqian@163.com/

Best regards,
Qingshuang Fu <fuqingshuang@kylinos.cn>

Re:Re: [PATCH 1/1] irqchip/renesas-irqc: fix generic IRQ chip leak on remove

[Thomas Gleixner]

On Tue, Jul 07 2026 at 14:56, Qingshuang Fu wrote:
> At 2026-06-12 15:44:15, "Geert Uytterhoeven" <geert@linux-m68k.org> wrote:
> The patch adds missing irq_domain_remove_generic_chips() cleanup path
> in probe error handling, no functional breakage.  Could you help merge
> it when you have time?

How about pinging the maintainer or resending the patch with [RESEND] in
the subject line?

That patch never made it into my inbox for whatever reasons, so it's not
a surprise that it is not merged.

Thanks,

        tglx

[PATCH v3 RESEND] irqchip/renesas-irqc: fix generic IRQ chip leak on remove

[Qingshuang Fu]

From: Qingshuang Fu <fuqingshuang@kylinos.cn>

The driver allocates domain generic chips using
irq_alloc_domain_generic_chips() during probe. However, on driver
remove, the generic chips are not automatically freed when the IRQ
domain is removed because the domain flags do not include
IRQ_DOMAIN_FLAG_DESTROY_GC.

This causes both the domain generic chips structure and the associated
generic chips to be leaked. Additionally, the generic chips remain on
the global gc_list and may later be visited by generic IRQ chip suspend,
resume, or shutdown callbacks after the driver has been removed,
potentially resulting in a use-after-free and kernel crash.

Fix the resource leak by explicitly calling
irq_domain_remove_generic_chips() before removing the IRQ domain in
both irqc_remove() and the probe error path.

Fixes: 99c221df33fbfa1b ("irqchip/renesas-irqc: Move over to nested generic chip")
Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
 drivers/irqchip/irq-renesas-irqc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/irqchip/irq-renesas-irqc.c b/drivers/irqchip/irq-renesas-irqc.c
index a20a6471b0e4..a340d27dd8d7 100644
--- a/drivers/irqchip/irq-renesas-irqc.c
+++ b/drivers/irqchip/irq-renesas-irqc.c
@@ -211,6 +211,7 @@ static int irqc_probe(struct platform_device *pdev)
 	return 0;
 
 err_remove_domain:
+	irq_domain_remove_generic_chips(p->irq_domain);
 	irq_domain_remove(p->irq_domain);
 err_runtime_pm_disable:
 	pm_runtime_put(dev);
@@ -222,6 +223,7 @@ static void irqc_remove(struct platform_device *pdev)
 {
 	struct irqc_priv *p = platform_get_drvdata(pdev);
 
+	irq_domain_remove_generic_chips(p->irq_domain);
 	irq_domain_remove(p->irq_domain);
 	pm_runtime_put(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);

base-commit: 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53
-- 
2.25.1

Re: [PATCH v3 RESEND] irqchip/renesas-irqc: fix generic IRQ chip leak on remove

[Thomas Gleixner]

On Wed, Jul 08 2026 at 10:09, Qingshuang Fu wrote:

Please use 'interrupts' and not 'IRQ'. This is prose text and not twitter.

> diff --git a/drivers/irqchip/irq-renesas-irqc.c b/drivers/irqchip/irq-renesas-irqc.c
> index a20a6471b0e4..a340d27dd8d7 100644
> --- a/drivers/irqchip/irq-renesas-irqc.c
> +++ b/drivers/irqchip/irq-renesas-irqc.c
> @@ -211,6 +211,7 @@ static int irqc_probe(struct platform_device *pdev)
>  	return 0;

>  err_remove_domain:
> +	irq_domain_remove_generic_chips(p->irq_domain);
>  	irq_domain_remove(p->irq_domain);
>  err_runtime_pm_disable:
>  	pm_runtime_put(dev);
> @@ -222,6 +223,7 @@ static void irqc_remove(struct platform_device *pdev)
>  {
>  	struct irqc_priv *p = platform_get_drvdata(pdev);
>  
> +	irq_domain_remove_generic_chips(p->irq_domain);
>  	irq_domain_remove(p->irq_domain);
>  	pm_runtime_put(&pdev->dev);
>  	pm_runtime_disable(&pdev->dev);

That can be simplified by doing:

     p->irq_domain->flags |= IRQ_DOMAIN_FLAG_DESTROY_GC

Thanks,

        tglx

[PATCH v4] irqchip/renesas-irqc: fix generic interrupt chip leak on remove

[Qingshuang Fu]

From: Qingshuang Fu <fuqingshuang@kylinos.cn>

The driver allocates domain generic chips using
irq_alloc_domain_generic_chips() during probe. However, on driver
remove, the generic chips are not automatically freed when the interrupt
domain is removed because the domain flags do not include
IRQ_DOMAIN_FLAG_DESTROY_GC.

This causes both the domain generic chips structure and the associated
generic chips to be leaked. Additionally, the generic chips remain on
the global gc_list and may later be visited by generic interrupt chip
suspend, resume, or shutdown callbacks after the driver has been removed,
potentially resulting in a use-after-free and kernel crash.

Fix the resource leak by setting IRQ_DOMAIN_FLAG_DESTROY_GC on the
interrupt domain; this lets the interrupt domain core automatically
release all generic chips when irq_domain_remove() is called, removing
the need for manual cleanup calls in error paths and remove callback.

Fixes: 99c221df33fbfa1b ("irqchip/renesas-irqc: Move over to nested generic chip")
Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
 drivers/irqchip/irq-renesas-irqc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-renesas-irqc.c b/drivers/irqchip/irq-renesas-irqc.c
index a20a6471b0e4..4b8b86c89b6a 100644
--- a/drivers/irqchip/irq-renesas-irqc.c
+++ b/drivers/irqchip/irq-renesas-irqc.c
@@ -194,6 +194,9 @@ static int irqc_probe(struct platform_device *pdev)
 	p->gc->chip_types[0].chip.irq_set_wake	= irqc_irq_set_wake;
 	p->gc->chip_types[0].chip.flags	= IRQCHIP_MASK_ON_SUSPEND;
 
+	/* Automatically free generic chips when interrupt domain is destroyed */
+	p->irq_domain->flags |= IRQ_DOMAIN_FLAG_DESTROY_GC;
+
 	irq_domain_set_pm_device(p->irq_domain, dev);
 
 	/* request interrupts one by one */

base-commit: 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53
-- 
2.25.1

Re: [PATCH v4] irqchip/renesas-irqc: fix generic interrupt chip leak on remove

[Geert Uytterhoeven]

Hi Qingshuang,

On Wed, 8 Jul 2026 at 11:39, Qingshuang Fu <fffsqian@163.com> wrote:
> From: Qingshuang Fu <fuqingshuang@kylinos.cn>
>
> The driver allocates domain generic chips using
> irq_alloc_domain_generic_chips() during probe. However, on driver
> remove, the generic chips are not automatically freed when the interrupt
> domain is removed because the domain flags do not include
> IRQ_DOMAIN_FLAG_DESTROY_GC.
>
> This causes both the domain generic chips structure and the associated
> generic chips to be leaked. Additionally, the generic chips remain on
> the global gc_list and may later be visited by generic interrupt chip
> suspend, resume, or shutdown callbacks after the driver has been removed,
> potentially resulting in a use-after-free and kernel crash.
>
> Fix the resource leak by setting IRQ_DOMAIN_FLAG_DESTROY_GC on the
> interrupt domain; this lets the interrupt domain core automatically
> release all generic chips when irq_domain_remove() is called, removing
> the need for manual cleanup calls in error paths and remove callback.
>
> Fixes: 99c221df33fbfa1b ("irqchip/renesas-irqc: Move over to nested generic chip")

Thanks for the update!
No changelog?

> Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>

Please do not retain Rb-tags when completely changing a patch.

> --- a/drivers/irqchip/irq-renesas-irqc.c
> +++ b/drivers/irqchip/irq-renesas-irqc.c
> @@ -194,6 +194,9 @@ static int irqc_probe(struct platform_device *pdev)
>         p->gc->chip_types[0].chip.irq_set_wake  = irqc_irq_set_wake;
>         p->gc->chip_types[0].chip.flags = IRQCHIP_MASK_ON_SUSPEND;
>
> +       /* Automatically free generic chips when interrupt domain is destroyed */

I am not sure you need the comment.

> +       p->irq_domain->flags |= IRQ_DOMAIN_FLAG_DESTROY_GC;
> +

LGTM, but you may want to do this right after creating p->irq_domain,
like is done in pdc_intc_probe().

>         irq_domain_set_pm_device(p->irq_domain, dev);
>
>         /* request interrupts one by one */
>

Gr{oetje,eeting}s,

                        Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds

[PATCH v5] irqchip/renesas-irqc: fix generic interrupt chip leak on remove

[Qingshuang Fu]

From: Qingshuang Fu <fuqingshuang@kylinos.cn>

The driver allocates domain generic chips using
irq_alloc_domain_generic_chips() during probe. However, on driver
remove, the generic chips are not automatically freed when the interrupt
domain is removed because the domain flags do not include
IRQ_DOMAIN_FLAG_DESTROY_GC.

This causes both the domain generic chips structure and the associated
generic chips to be leaked. Additionally, the generic chips remain on
the global gc_list and may later be visited by generic interrupt chip
suspend, resume, or shutdown callbacks after the driver has been removed,
potentially resulting in a use-after-free and kernel crash.

Fix the resource leak by setting IRQ_DOMAIN_FLAG_DESTROY_GC on the
interrupt domain; this lets the interrupt domain core automatically
release all generic chips when irq_domain_remove() is called, removing
the need for manual cleanup calls in error paths and remove callback.

Fixes: 99c221df33fbfa1b ("irqchip/renesas-irqc: Move over to nested generic chip")
Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
---
Changes from v1 to v2:
- Corrected wrong Fixes commit ID per Geert's review

Changes from v2 to v3:
- Reword commit prose to use full "interrupt" instead of shorthand "IRQ"
- Add manual irq_domain_remove_generic_chips() cleanup in probe error path and remove callback to fix leak

Changes from v3 to v4:
- Adopt tglx's suggestion: set IRQ_DOMAIN_FLAG_DESTROY_GC instead of manual
  irq_domain_remove_generic_chips() cleanup calls

Changes from v4 to v5:
1. Move IRQ_DOMAIN_FLAG_DESTROY_GC assignment right after irq_domain creation
   to align with similar drivers like pdc_intc_probe()
2. Drop redundant comment for flag assignment
3. Remove old Reviewed-by tag since the implementation logic was fully changed

 drivers/irqchip/irq-renesas-irqc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/irqchip/irq-renesas-irqc.c b/drivers/irqchip/irq-renesas-irqc.c
index a20a6471b0e4..1ff3535a4617 100644
--- a/drivers/irqchip/irq-renesas-irqc.c
+++ b/drivers/irqchip/irq-renesas-irqc.c
@@ -176,6 +176,7 @@ static int irqc_probe(struct platform_device *pdev)
 		goto err_runtime_pm_disable;
 	}
 
+	p->irq_domain->flags |= IRQ_DOMAIN_FLAG_DESTROY_GC;
 	ret = irq_alloc_domain_generic_chips(p->irq_domain, p->number_of_irqs,
 					     1, "irqc", handle_level_irq,
 					     0, 0, IRQ_GC_INIT_NESTED_LOCK);

base-commit: 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53
-- 
2.25.1

Re:Re: [PATCH v4] irqchip/renesas-irqc: fix generic interrupt chip leak on remove

[Qingshuang Fu]

At 2026-07-08 17:48:07, "Geert Uytterhoeven" <geert@linux-m68k.org> wrote:
>Hi Qingshuang,
>
>On Wed, 8 Jul 2026 at 11:39, Qingshuang Fu <fffsqian@163.com> wrote:
>> From: Qingshuang Fu <fuqingshuang@kylinos.cn>
>>
>> The driver allocates domain generic chips using
>> irq_alloc_domain_generic_chips() during probe. However, on driver
>> remove, the generic chips are not automatically freed when the interrupt
>> domain is removed because the domain flags do not include
>> IRQ_DOMAIN_FLAG_DESTROY_GC.
>>
>> This causes both the domain generic chips structure and the associated
>> generic chips to be leaked. Additionally, the generic chips remain on
>> the global gc_list and may later be visited by generic interrupt chip
>> suspend, resume, or shutdown callbacks after the driver has been removed,
>> potentially resulting in a use-after-free and kernel crash.
>>
>> Fix the resource leak by setting IRQ_DOMAIN_FLAG_DESTROY_GC on the
>> interrupt domain; this lets the interrupt domain core automatically
>> release all generic chips when irq_domain_remove() is called, removing
>> the need for manual cleanup calls in error paths and remove callback.
>>
>> Fixes: 99c221df33fbfa1b ("irqchip/renesas-irqc: Move over to nested generic chip")
>
>Thanks for the update!
>No changelog?
>
>> Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
>> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
>
>Please do not retain Rb-tags when completely changing a patch.
>
>> --- a/drivers/irqchip/irq-renesas-irqc.c
>> +++ b/drivers/irqchip/irq-renesas-irqc.c
>> @@ -194,6 +194,9 @@ static int irqc_probe(struct platform_device *pdev)
>>         p->gc->chip_types[0].chip.irq_set_wake  = irqc_irq_set_wake;
>>         p->gc->chip_types[0].chip.flags = IRQCHIP_MASK_ON_SUSPEND;
>>
>> +       /* Automatically free generic chips when interrupt domain is destroyed */
>
>I am not sure you need the comment.
>
>> +       p->irq_domain->flags |= IRQ_DOMAIN_FLAG_DESTROY_GC;
>> +
>
>LGTM, but you may want to do this right after creating p->irq_domain,
>like is done in pdc_intc_probe().
>
>>         irq_domain_set_pm_device(p->irq_domain, dev);
>>
>>         /* request interrupts one by one */
>>
>
>Gr{oetje,eeting}s,
>
>                        Geert
>
>-- 
>Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
>
>In personal conversations with technical people, I call myself a hacker. But
>when I'm talking to journalists I just say "programmer" or something like that.
>                                -- Linus Torvalds


Hi Geert,

Thanks for your review. I've updated the patch to v5 as your suggestions:
1. Added full version changelog under split line.
2. Moved IRQ_DOMAIN_FLAG_DESTROY_GC assignment right after irq_domain creation.
3. Removed redundant comment and dropped old Reviewed-by tag as implementation fully changed.

v5 patch attached.

Qingshuang Fu

[tip: irq/drivers] irqchip/renesas-irqc: Fix generic interrupt chip leak on remove

[tip-bot2 for Qingshuang Fu]

The following commit has been merged into the irq/drivers branch of tip:

Commit-ID:     616dd89d81ad9a3cf1cfff4088a4c43e4e00d6ba
Gitweb:        https://git.kernel.org/tip/616dd89d81ad9a3cf1cfff4088a4c43e4e00d6ba
Author:        Qingshuang Fu <fuqingshuang@kylinos.cn>
AuthorDate:    Wed, 08 Jul 2026 18:08:46 +08:00
Committer:     Thomas Gleixner <tglx@kernel.org>
CommitterDate: Wed, 15 Jul 2026 09:10:46 +02:00

irqchip/renesas-irqc: Fix generic interrupt chip leak on remove

The driver allocates domain generic chips probe. However, on driver
removal, the generic chips are not automatically freed when the interrupt
domain is removed because the domain flags do not include
IRQ_DOMAIN_FLAG_DESTROY_GC.

This causes both the domain generic chips structure and the associated
generic chips to be leaked. Additionally, the generic chips remain on the
global list and may later be accessed by generic interrupt chip suspend,
resume, or shutdown callbacks after the driver has been removed,
potentially resulting in a use-after-free and kernel crash.

Fix the resource leak by setting IRQ_DOMAIN_FLAG_DESTROY_GC on the
interrupt domain; this lets the interrupt domain core automatically
release all generic chips when irq_domain_remove() is invoked, removing
the need for manual cleanup calls in error paths and remove callback.

Fixes: 99c221df33fbfa1b ("irqchip/renesas-irqc: Move over to nested generic chip")
Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260708100846.506314-1-fffsqian@163.com
---
 drivers/irqchip/irq-renesas-irqc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/irqchip/irq-renesas-irqc.c b/drivers/irqchip/irq-renesas-irqc.c
index a20a647..1ff3535 100644
--- a/drivers/irqchip/irq-renesas-irqc.c
+++ b/drivers/irqchip/irq-renesas-irqc.c
@@ -176,6 +176,7 @@ static int irqc_probe(struct platform_device *pdev)
 		goto err_runtime_pm_disable;
 	}
 
+	p->irq_domain->flags |= IRQ_DOMAIN_FLAG_DESTROY_GC;
 	ret = irq_alloc_domain_generic_chips(p->irq_domain, p->number_of_irqs,
 					     1, "irqc", handle_level_irq,
 					     0, 0, IRQ_GC_INIT_NESTED_LOCK);