]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
irqchip/ts4800: Fix missing chained handler cleanup on remove
authorQingshuang Fu <fuqingshuang@kylinos.cn>
Tue, 23 Jun 2026 01:52:11 +0000 (09:52 +0800)
committerThomas Gleixner <tglx@kernel.org>
Tue, 30 Jun 2026 16:49:48 +0000 (18:49 +0200)
commit98bf7e54cec07d514b3575c11896a8b12d50ecc4
treebcf3ea35a517e5048562e1958b2cc82d2130a675
parent2e1368a9d61bdf5502ddade004f223a5831c5b8c
irqchip/ts4800: Fix missing chained handler cleanup on remove

The driver installs a chained handler for the parent interrupt during probe
using irq_set_chained_handler_and_data(), but the remove function does not
clear this handler. This leaves a dangling handler that may be called when
the parent interrupt fires after the driver has been removed, potentially
accessing freed memory and causing a kernel crash.

Additionally, the parent_irq obtained via irq_of_parse_and_map() is not
stored, making it inaccessible in the remove function. Moreover, interrupt
mappings created during probe are not properly disposed.

Fix this by:

   - Saving parent_irq in probe
   - Clearing the chained handler with NULL in ts4800_ic_remove()
   - Disposing all IRQ mappings before domain removal to prevent resource
     leaks

Fixes: d01f8633d52e ("irqchip/ts4800: Add TS-4800 interrupt controller")
Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260623015211.109382-1-fffsqian@163.com
drivers/irqchip/irq-ts4800.c