Re: [PATCH v2 1/5] genirq: Synchronize in-flight handlers during NMI teardown

[Doug Anderson]

Hi,

On Fri, Aug 28, 2026 at 6:00 PM Mayank Rungta <mrungta@xxxxxxxxxx> wrote:
>
> When freeing an interrupt requested via request_nmi(), __cleanup_nmi()
> currently tears down the NMI and frees the irqaction structure without
> waiting for in-flight instances of the handler on other CPUs to complete,
> which can lead to use-after-free conditions on module unload.
>
> Because NMIs cannot acquire desc->lock or set IRQD_IRQ_INPROGRESS without
> risking deadlocks, synchronizing in-flight NMIs on other CPUs during
> teardown (__synchronize_hardirq) relies on querying the hardware
> controller state via __irq_get_irqchip_state(IRQCHIP_STATE_ACTIVE).
>
> Enforce that any interrupt controller claiming NMI support via
> IRQCHIP_SUPPORTS_NMI must implement ->irq_get_irqchip_state(). In
> __cleanup_nmi(), shut down the line, call __synchronize_hardirq(desc, true)
> to wait for in-flight handlers, and only then tear down the NMI
> configuration and deactivate the interrupt domain before freeing the action
> structure.
>
> Also add a WARN(in_interrupt()) check in free_nmi() matching __free_irq()
> to prevent freeing NMIs from atomic contexts since synchronization and
> resource cleanup can sleep and spin.
>
> Assisted-by: Antigravity:gemini
> Signed-off-by: Mayank Rungta <mrungta@xxxxxxxxxx>
> ---
>  kernel/irq/manage.c | 25 ++++++++++++++++++++-----
>  1 file changed, 20 insertions(+), 5 deletions(-)

FWIW, Sashiko's feedback [1] again seems relevant, so probably a v3 is
worthwhile.

[1] https://lore.kernel.org/all/20260829011449.87AF11F000E9@xxxxxxxxxxxxxxx/