[tip: irq/drivers] irqdomain: Set IRQ_DOMAIN_FLAG_DESTROY_GC in __irq_domain_instantiate()

[tip-bot2 for Qingshuang Fu]

The following commit has been merged into the irq/drivers branch of tip:

Commit-ID:     0aa45dce2afe6960865de1f32fabd716efaa6fdb
Gitweb:        https://git.kernel.org/tip/0aa45dce2afe6960865de1f32fabd716efaa6fdb
Author:        Qingshuang Fu <fuqingshuang@xxxxxxxxxx>
AuthorDate:    Mon, 07 Sep 2026 10:40:44 +08:00
Committer:     Thomas Gleixner <tglx@xxxxxxxxxx>
CommitterDate: Mon, 07 Sep 2026 21:49:58 +02:00

irqdomain: Set IRQ_DOMAIN_FLAG_DESTROY_GC in __irq_domain_instantiate()

When a driver uses irq_domain_instantiate() with dgc_info to create
generic irq chips, IRQ_DOMAIN_FLAG_DESTROY_GC is required so that
irq_domain_remove() can clean up those generic chips.

All existing in-tree callers manually set this flag today, but this
pattern is error-prone. A future new caller forgetting to set the flag
would leave generic chips allocated by irq_domain_alloc_generic_chips()
leaked on domain removal.

Set IRQ_DOMAIN_FLAG_DESTROY_GC right after
irq_domain_alloc_generic_chips() succeeds inside
__irq_domain_instantiate().  This makes automatic cleanup the default
for all users that provide dgc_info via irq_domain_instantiate().

This is the correct location for the flag because:

  - irq_domain_instantiate() is a high-level wrapper which internally
    allocates the generic chips, so it should also take responsibility
    for arranging their cleanup.

  - Setting the flag in irq_domain_alloc_generic_chips() would affect
    legacy callers like __irq_alloc_domain_generic_chips(), some of
    which have custom cleanup paths that manually free the generic
    chips (e.g. gpio-tb10x does kfree(domain->gc) before
    irq_domain_remove()), leading to use-after-free.

Signed-off-by: Qingshuang Fu <fuqingshuang@xxxxxxxxxx>
Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxx>
Reviewed-by: Herve Codina <herve.codina@xxxxxxxxxxx>
Link: https://patch.msgid.link/20260907024046.28845-2-fuqingshuang@xxxxxxxxxx
---
 kernel/irq/irqdomain.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index 57c819d..4fdcb6d 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -344,6 +344,7 @@ static struct irq_domain *__irq_domain_instantiate(const struct irq_domain_info 
 		err = irq_domain_alloc_generic_chips(domain, info->dgc_info);
 		if (err)
 			goto err_domain_free;
+		domain->flags |= IRQ_DOMAIN_FLAG_DESTROY_GC;
 	}
 
 	if (info->init) {