Re: [PATCH 1/3] soc: qcom: smp2p: Fix use-after-free of irq domain on removal
From: Krzysztof Kozlowski
Date: Mon Nov 02 2026 - 05:37:31 EST
On 02/11/2026 11:28, Konrad Dybcio wrote:
> On 11/1/26 9:24 PM, Krzysztof Kozlowski wrote:
>> The SMP2P interrupt is requested with devm_request_threaded_irq(), so it
>> is freed only after qcom_smp2p_remove() returns or, in the probe error
>> path, after probe returns. Both paths, however, explicitly remove the
>> inbound irq domains, unregister outbound SMEM states and free the
>> mailbox channel before that.
>
> Sashiko flags an issue with this one
Thanks, Sashiko did not send email about it.
Best regards,
Krzysztof