[PATCH v5] irqchip/renesas-irqc: fix generic interrupt chip leak on remove

[Qingshuang Fu]

From: Qingshuang Fu <fuqingshuang@xxxxxxxxxx>

The driver allocates domain generic chips using
irq_alloc_domain_generic_chips() during probe. However, on driver
remove, the generic chips are not automatically freed when the interrupt
domain is removed because the domain flags do not include
IRQ_DOMAIN_FLAG_DESTROY_GC.

This causes both the domain generic chips structure and the associated
generic chips to be leaked. Additionally, the generic chips remain on
the global gc_list and may later be visited by generic interrupt chip
suspend, resume, or shutdown callbacks after the driver has been removed,
potentially resulting in a use-after-free and kernel crash.

Fix the resource leak by setting IRQ_DOMAIN_FLAG_DESTROY_GC on the
interrupt domain; this lets the interrupt domain core automatically
release all generic chips when irq_domain_remove() is called, removing
the need for manual cleanup calls in error paths and remove callback.

Fixes: 99c221df33fbfa1b ("irqchip/renesas-irqc: Move over to nested generic chip")
Signed-off-by: Qingshuang Fu <fuqingshuang@xxxxxxxxxx>
---
Changes from v1 to v2:
- Corrected wrong Fixes commit ID per Geert's review

Changes from v2 to v3:
- Reword commit prose to use full "interrupt" instead of shorthand "IRQ"
- Add manual irq_domain_remove_generic_chips() cleanup in probe error path and remove callback to fix leak

Changes from v3 to v4:
- Adopt tglx's suggestion: set IRQ_DOMAIN_FLAG_DESTROY_GC instead of manual
  irq_domain_remove_generic_chips() cleanup calls

Changes from v4 to v5:
1. Move IRQ_DOMAIN_FLAG_DESTROY_GC assignment right after irq_domain creation
   to align with similar drivers like pdc_intc_probe()
2. Drop redundant comment for flag assignment
3. Remove old Reviewed-by tag since the implementation logic was fully changed

 drivers/irqchip/irq-renesas-irqc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/irqchip/irq-renesas-irqc.c b/drivers/irqchip/irq-renesas-irqc.c
index a20a6471b0e4..1ff3535a4617 100644
--- a/drivers/irqchip/irq-renesas-irqc.c
+++ b/drivers/irqchip/irq-renesas-irqc.c
@@ -176,6 +176,7 @@ static int irqc_probe(struct platform_device *pdev)
 		goto err_runtime_pm_disable;
 	}
 
+	p->irq_domain->flags |= IRQ_DOMAIN_FLAG_DESTROY_GC;
 	ret = irq_alloc_domain_generic_chips(p->irq_domain, p->number_of_irqs,
 					     1, "irqc", handle_level_irq,
 					     0, 0, IRQ_GC_INIT_NESTED_LOCK);

base-commit: 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53
-- 
2.25.1