Re: [BUG] KASAN: slab-use-after-free Read in irq_migrate_all_off_this_cpu

[Mark Brown <broonie@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 1863 bytes --]

On Sun, Aug 30, 2026 at 08:24:04AM +0200, Thomas Gleixner wrote:

> Though based on the meager information I think I roughly can see how
> that happens not only in the reported version. It's still the same
> problem upstream.

> Allocation happens at:

> regmap_add_irq_chip_fwnode+0x375/0x2dd0 drivers/base/regmap/regmap-irq.c:709

>          d = kzalloc_obj(*d);

> That's initialized and then handed in as host_data when the interrupt
> domain is created.

Huh, due to the lack of information in the report that you noted I'd
thought this was misdirected due to -next or something...

> regmap_add_irq_chip_fwnode+0xd76/0x2dd0 drivers/base/regmap/regmap-irq.c:963

> Interestingly enough the code has a comment in that failure path:

> err_domain:
>         /* Should really dispose of the domain but... */

> And it should dispose the domain properly which also would remove and
> free the interrupt descriptors.

...

> Mark, do you remember why you ended up with adding this comment instead
> of actualy mopping up the domain?

I believe that at the time there was no way of freeing irqdomains, or I
couldn't find it.  irq_domain_remove() was added in May 2012 as a bit of
an afterthought in 58ee99ada293b (irqdomain: Support removal of IRQ
domains.), the above comment was added in the same month so won't have
been in the kernel I was working on.  This was one of the first users
that wasn't arch code I think, having an interrupt controller that wasnt
arch code had a bunch of fun at that point in time.  I do remember being
confused about why there wasn't a remove function and I imagine I meant
to go back and figure something out there but clearly never got round to
it, practically speaking the regmap-irq code was being used by things
like PMICs that would never actually get removed so this path was never
getting exercised.

I'll add the cleanup.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]