From 0aa45dce2afe6960865de1f32fabd716efaa6fdb Mon Sep 17 00:00:00 2001 From: Qingshuang Fu Date: Mon, 7 Sep 2026 10:40:44 +0800 Subject: irqdomain: Set IRQ_DOMAIN_FLAG_DESTROY_GC in __irq_domain_instantiate() When a driver uses irq_domain_instantiate() with dgc_info to create generic irq chips, IRQ_DOMAIN_FLAG_DESTROY_GC is required so that irq_domain_remove() can clean up those generic chips. All existing in-tree callers manually set this flag today, but this pattern is error-prone. A future new caller forgetting to set the flag would leave generic chips allocated by irq_domain_alloc_generic_chips() leaked on domain removal. Set IRQ_DOMAIN_FLAG_DESTROY_GC right after irq_domain_alloc_generic_chips() succeeds inside __irq_domain_instantiate(). This makes automatic cleanup the default for all users that provide dgc_info via irq_domain_instantiate(). This is the correct location for the flag because: - irq_domain_instantiate() is a high-level wrapper which internally allocates the generic chips, so it should also take responsibility for arranging their cleanup. - Setting the flag in irq_domain_alloc_generic_chips() would affect legacy callers like __irq_alloc_domain_generic_chips(), some of which have custom cleanup paths that manually free the generic chips (e.g. gpio-tb10x does kfree(domain->gc) before irq_domain_remove()), leading to use-after-free. Signed-off-by: Qingshuang Fu Signed-off-by: Thomas Gleixner Reviewed-by: Herve Codina Link: https://patch.msgid.link/20260907024046.28845-2-fuqingshuang@kylinos.cn --- kernel/irq/irqdomain.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c index 57c819da30c2..4fdcb6df5306 100644 --- a/kernel/irq/irqdomain.c +++ b/kernel/irq/irqdomain.c @@ -344,6 +344,7 @@ static struct irq_domain *__irq_domain_instantiate(const struct irq_domain_info err = irq_domain_alloc_generic_chips(domain, info->dgc_info); if (err) goto err_domain_free; + domain->flags |= IRQ_DOMAIN_FLAG_DESTROY_GC; } if (info->init) { -- cgit v1.2.3