irqchip/ts4800: Fix missing chained handler cleanup on remove

The driver installs a chained handler for the parent interrupt during probe
using irq_set_chained_handler_and_data(), but the remove function does not
clear this handler. This leaves a dangling handler that may be called when
the parent interrupt fires after the driver has been removed, potentially
accessing freed memory and causing a kernel crash.

Additionally, the parent_irq obtained via irq_of_parse_and_map() is not
stored, making it inaccessible in the remove function. Moreover, interrupt
mappings created during probe are not properly disposed.

Fix this by:

   - Saving parent_irq in probe
   - Clearing the chained handler with NULL in ts4800_ic_remove()
   - Disposing all IRQ mappings before domain removal to prevent resource
     leaks

Fixes: d01f8633d52e ("irqchip/ts4800: Add TS-4800 interrupt controller")
Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260623015211.109382-1-fffsqian@163.com

diff --git a/drivers/irqchip/irq-ts4800.c b/drivers/irqchip/irq-ts4800.c
index 2e4013c6834de163e5bfdb713f0bab5c65f3b0f1..c7c0b155e353eea55e8e6737434c44ec1402e513 100644 (file)
--- a/drivers/irqchip/irq-ts4800.c
+++ b/drivers/irqchip/irq-ts4800.c
@@ -28,6 +28,7 @@ struct ts4800_irq_data {
        void __iomem            *base;
        struct platform_device  *pdev;
        struct irq_domain       *domain;
+       unsigned int            parent_irq;
 };
 
 static void ts4800_irq_mask(struct irq_data *d)
@@ -134,6 +135,7 @@ static int ts4800_ic_probe(struct platform_device *pdev)
        irq_set_chained_handler_and_data(parent_irq,
                                         ts4800_ic_chained_handle_irq, data);
 
+       data->parent_irq = parent_irq;
        platform_set_drvdata(pdev, data);
 
        return 0;
@@ -142,6 +144,14 @@ static int ts4800_ic_probe(struct platform_device *pdev)
 static void ts4800_ic_remove(struct platform_device *pdev)
 {
        struct ts4800_irq_data *data = platform_get_drvdata(pdev);
+       unsigned int hwirq;
+
+       irq_set_chained_handler_and_data(data->parent_irq, NULL, NULL);
+
+       for (hwirq = 0; hwirq < 8; hwirq++)
+               irq_dispose_mapping(irq_find_mapping(data->domain, hwirq));
+
+       irq_dispose_mapping(data->parent_irq);
 
        irq_domain_remove(data->domain);
 }