Re: [PATCH] regmap: irq: Free the irqdomain we create

[Thomas Gleixner]

On Fri, Sep 04 2026 at 21:00, Thomas Gleixner wrote:
> On Tue, Sep 01 2026 at 22:55, Mark Brown wrote:
>>  err_domain:
>> -	/* Should really dispose of the domain but... */
>> +	irq_domain_remove(d->domain);
>
> That won't work.
>
> The case which is affected is the one which allocates interrupts
> upfront via alloc_irq_descs().
>
> In that case the domain creation will associate allocated interrupts
> because info.virq_base is > 0.
>
> This wont trigger the WARN_ON() in irq_domain_remove() because it's a
> fixed sized linear domain, but irq_domain_remove() will leak the
> interrupt descriptors which still have a reference (pointer) to the irq
> chip and the domain. So the same UAF is still there :)
>
> What you need to do before removing the domain is
>
>      if (irq_base > 0)
>      	irq_domain_free_irqs(irq_base, chip->num_irqs);

Hit send too fast. That stupidly works only when hierarchical domains
are enabled.

So you need:

      if (irq_base > 0) {
      	  for (unsigned int i = 0; i < chip->num_irqs; i++)
          	irq_dispose_mapping(irq_base + i);
      }
      irqdomain_remove_domain();

Thanks,

        tglx