Re: (subset) [PATCH v2 1/3] soc: qcom: smp2p: Fix use-after-free of irq domain on removal

[Bjorn Andersson]

On Mon, 02 Nov 2026 14:35:32 +0100, Krzysztof Kozlowski wrote:
> The SMP2P interrupt is requested with devm_request_threaded_irq(), so it
> is freed only after qcom_smp2p_remove() returns or, in the probe error
> path, after probe returns.   Both paths, however, explicitly remove the
> inbound irq domains, unregister outbound SMEM states and free the
> mailbox channel before that.
> 
> If the interrupt is triggered in this window, the interrupt handler
> would use previously freed data.  Mixing manual probe() cleanup
> and resource-managed devm leads to such races, thus just convert
> as much as possible to devm to fix the issue and make code simpler.
> 
> [...]

Applied, thanks!

[1/3] soc: qcom: smp2p: Fix use-after-free of irq domain on removal
      commit: 357af2197e419ff4918e1581b958f4832b94c699
[2/3] soc: qcom: smp2p: Fix out-of-bounds with incorrect DTB of too many outbound entries
      commit: be72e07d039377d1b4e07b54ec32908a4f63d3e4
[3/3] soc: qcom: smp2p: Fix possible out-of-bounds read with too many inbound entries
      commit: 72525c6d8cda880fce80d453493878c4dc12fe15

Best regards,
-- 
Bjorn Andersson <andersson@xxxxxxxxxx>