Re: [PATCH] regmap: irq: Free the irqdomain we create

[Thomas Gleixner <tglx@kernel.org>]

On Tue, Sep 01 2026 at 22:55, Mark Brown wrote:
> When domain support was added to regmap-irq it was not possible to
> remove domains, this was added later by 8ee99ada293b (irqdomain: Support
> removal of IRQ domains.).  We did update the main removal path to free
> the domain but forgot the error unwinding case during creation that is
> now in regmap_add_irq_chip_fwnode() after some code motion, meaning that
> errors during instantiation result in an unused irqchip being left
> hanging around.  Add the missing irq_remove_domain() call where the
> comment says it should be.
>
> Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
> Reported-by: Thomas Gleixner <tglx@kernel.org>
> Signed-off-by: Mark Brown <broonie@kernel.org>
> ---
>  drivers/base/regmap/regmap-irq.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-irq.c
> index 99b55b1053ee..715eb9e7aa2a 100644
> --- a/drivers/base/regmap/regmap-irq.c
> +++ b/drivers/base/regmap/regmap-irq.c
> @@ -963,7 +963,7 @@ int regmap_add_irq_chip_fwnode(struct fwnode_handle *fwnode,
>  	return 0;
>  
>  err_domain:
> -	/* Should really dispose of the domain but... */
> +	irq_domain_remove(d->domain);

That won't work.

The case which is affected is the one which allocates interrupts
upfront via alloc_irq_descs().

In that case the domain creation will associate allocated interrupts
because info.virq_base is > 0.

This wont trigger the WARN_ON() in irq_domain_remove() because it's a
fixed sized linear domain, but irq_domain_remove() will leak the
interrupt descriptors which still have a reference (pointer) to the irq
chip and the domain. So the same UAF is still there :)

What you need to do before removing the domain is

     if (irq_base > 0)
     	irq_domain_free_irqs(irq_base, chip->num_irqs);

Thanks,

        tglx