Re:Re: [PATCH 1/1] irqchip/renesas-irqc: fix generic IRQ chip leak on remove

[Qingshuang Fu]

At 2026-06-12 15:44:15, "Geert Uytterhoeven" <geert@xxxxxxxxxxxxxx> wrote:
>Hi Qingshuang,
>
>On Fri, 12 Jun 2026 at 08:55, <fffsqian@xxxxxxx> wrote:
>> From: Qingshuang Fu <fuqingshuang@xxxxxxxxxx>
>>
>> The driver allocates domain generic chips using
>> irq_alloc_domain_generic_chips() during probe. However, on driver
>> remove, the generic chips are not automatically freed when the IRQ
>> domain is removed because the domain flags do not include
>> IRQ_DOMAIN_FLAG_DESTROY_GC.
>>
>> This causes both the domain generic chips structure and the associated
>> generic chips to be leaked. Additionally, the generic chips remain on
>> the global gc_list and may later be visited by generic IRQ chip suspend,
>> resume, or shutdown callbacks after the driver has been removed,
>> potentially resulting in a use-after-free and kernel crash.
>>
>> Fix the resource leak by explicitly calling
>> irq_domain_remove_generic_chips() before removing the IRQ domain in
>> both irqc_remove() and the probe error path.
>
>Thanks for your patch!
>
>>
>> Fixes: 17c888920949 ("irqchip/renesas-irqc: Use proper irq_chip name and parent")
>
>Shouldn't that be
>
>Fixes: 99c221df33fbfa1b ("irqchip/renesas-irqc: Move over to nested
>generic chip")
>
>?
>
>> Signed-off-by: Qingshuang Fu <fuqingshuang@xxxxxxxxxx>
>
>> --- a/drivers/irqchip/irq-renesas-irqc.c
>> +++ b/drivers/irqchip/irq-renesas-irqc.c
>> @@ -211,6 +211,7 @@ static int irqc_probe(struct platform_device *pdev)
>>         return 0;
>>
>>  err_remove_domain:
>> +       irq_domain_remove_generic_chips(p->irq_domain);
>
>While I had expected a new label, this is indeed not needed, as
>irq_domain_remove_generic_chips() is a no-op if irq_domain.gc
>is NULL, which is the case if irq_domain_alloc_generic_chips() fails.
>
>>         irq_domain_remove(p->irq_domain);
>>  err_runtime_pm_disable:
>>         pm_runtime_put(dev);
>
>Reviewed-by: Geert Uytterhoeven <geert+renesas@xxxxxxxxx>
>
>Gr{oetje,eeting}s,
>
>                        Geert
>
>-- 
>Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@xxxxxxxxxxxxxx
>
>In personal conversations with technical people, I call myself a hacker. But
>when I'm talking to journalists I just say "programmer" or something like that.
>                                -- Linus Torvalds


Hi Geert,

Thanks a lot for your review and Reviewed-by tag.
I sent v2 patch one month ago, which corrected the wrong Fixes commit id as you suggested.

The patch adds missing irq_domain_remove_generic_chips() cleanup path in probe error handling, no functional breakage.
Could you help merge it when you have time?

v2 patch archive link:
https://lore.kernel.org/all/20260612082537.1212357-1-fffsqian@xxxxxxx/

Best regards,
Qingshuang Fu <fuqingshuang@xxxxxxxxxx>