[tip: irq/drivers] irqchip/imx-irqsteer: Dispose of child IRQ mappings in remove()

[tip-bot2 for Zhipeng Wang]

The following commit has been merged into the irq/drivers branch of tip:

Commit-ID:     2dc8bf99eefb6d811606b5a50e46fd507a7ab9d7
Gitweb:        https://git.kernel.org/tip/2dc8bf99eefb6d811606b5a50e46fd507a7ab9d7
Author:        Zhipeng Wang <zhipeng.wang_1@xxxxxxx>
AuthorDate:    Wed, 04 Nov 2026 16:37:56 +09:00
Committer:     Thomas Gleixner <tglx@xxxxxxxxxx>
CommitterDate: Sun, 08 Nov 2026 22:43:44 +01:00

irqchip/imx-irqsteer: Dispose of child IRQ mappings in remove()

Once the driver can be unloaded, the IRQ domain mappings handed out to
downstream consumers must be released on remove(), otherwise:

 - a parent interrupt racing with the teardown can run the chained
   handler while irqsteer_data is freed (no synchronize_irq());
 - downstream irq_descs keep dangling chip pointers into the unloaded
   module.

Dispose of every child hwirq mapping in remove(). irq_dispose_mapping()
calls irq_domain_disassociate(), which runs synchronize_irq() and frees
the descriptor, closing both races.

Signed-off-by: Zhipeng Wang <zhipeng.wang_1@xxxxxxx>
Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxx>
Reviewed-by: Radu Rendec <radu@xxxxxxxxxx>
Link: https://patch.msgid.link/20261104073759.386777-9-Zhipeng.wang_1@xxxxxxxxxxx
---
 drivers/irqchip/irq-imx-irqsteer.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-imx-irqsteer.c b/drivers/irqchip/irq-imx-irqsteer.c
index 234fd10..f234dec 100644
--- a/drivers/irqchip/irq-imx-irqsteer.c
+++ b/drivers/irqchip/irq-imx-irqsteer.c
@@ -295,6 +295,9 @@ static void imx_irqsteer_remove(struct platform_device *pdev)
 		irq_dispose_mapping(irqsteer_data->irq[i]);
 	}
 
+	for (unsigned int hwirq = 0; hwirq < irqsteer_data->reg_num * 32; hwirq++)
+		irq_dispose_mapping(irq_find_mapping(irqsteer_data->domain, hwirq));
+
 	irq_domain_remove(irqsteer_data->domain);
 
 	if (ret >= 0)