[tip: irq/drivers] irqchip/imx-irqsteer: Validate IRQ count before creating domain

[tip-bot2 for Fabio Estevam]

The following commit has been merged into the irq/drivers branch of tip:

Commit-ID:     f99f3c4acaff0df9393c1e6a3f28b7b974e01d95
Gitweb:        https://git.kernel.org/tip/f99f3c4acaff0df9393c1e6a3f28b7b974e01d95
Author:        Fabio Estevam <festevam@xxxxxxxxxxxx>
AuthorDate:    Wed, 04 Nov 2026 16:37:50 +09:00
Committer:     Thomas Gleixner <tglx@xxxxxxxxxx>
CommitterDate: Sun, 08 Nov 2026 22:43:43 +01:00

irqchip/imx-irqsteer: Validate IRQ count before creating domain

The IRQ count is validated after creating the IRQ domain. If it is
invalid, probe returns without removing the domain, leaving its host
data pointing at devm-managed memory that is freed on probe failure.

Validate the count before allocating resources to avoid the leak and
dangling pointer.

Fixes: 28528fca4908 ("irqchip/imx-irqsteer: Add multi output interrupts support")
Signed-off-by: Fabio Estevam <festevam@xxxxxxxxxxxx>
Signed-off-by: Zhipeng Wang <zhipeng.wang_1@xxxxxxx>
Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxx>
Reviewed-by: Frank Li <Frank.Li@xxxxxxx>
Reviewed-by: Radu Rendec <radu@xxxxxxxxxx>
Link: https://patch.msgid.link/20261104073759.386777-3-Zhipeng.wang_1@xxxxxxxxxxx
---
 drivers/irqchip/irq-imx-irqsteer.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/irqchip/irq-imx-irqsteer.c b/drivers/irqchip/irq-imx-irqsteer.c
index 1b8d0c8..766756e 100644
--- a/drivers/irqchip/irq-imx-irqsteer.c
+++ b/drivers/irqchip/irq-imx-irqsteer.c
@@ -218,6 +218,8 @@ static int imx_irqsteer_probe(struct platform_device *pdev)
 	 */
 	data->irq_count = DIV_ROUND_UP(irqs_num, 64);
 	data->reg_num = irqs_num / 32;
+	if (!data->irq_count || data->irq_count > CHAN_MAX_OUTPUT_INT)
+		return -EINVAL;
 
 	if (IS_ENABLED(CONFIG_PM)) {
 		data->saved_reg = devm_kzalloc(&pdev->dev,
@@ -246,11 +248,6 @@ static int imx_irqsteer_probe(struct platform_device *pdev)
 	}
 	irq_domain_set_pm_device(data->domain, &pdev->dev);
 
-	if (!data->irq_count || data->irq_count > CHAN_MAX_OUTPUT_INT) {
-		ret = -EINVAL;
-		goto out;
-	}
-
 	for (i = 0; i < data->irq_count; i++) {
 		data->irq[i] = irq_of_parse_and_map(np, i);
 		if (!data->irq[i])