From nobody Sat Jul 25 04:29:54 2026 Received: from mail-wm2-f9.google.com (mail-wm2-f9.google.com [74.125.225.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B06932EEE94 for ; Sat, 18 Jul 2026 11:51:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.225.137 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784375495; cv=none; b=lDyLzwau1O3sD85hqsweoMP5/gGecvXherhPnkhEb2y5fx2aCkVnnI9zItuzNjUV1+ouy+mqvDyCKY75hx2WR68QHtgWG+ccAd0D0gDAa0QFwFADuS0ew+RgjPnJJ/NZ+f4bbYA073/jnZwFQequC4zHkVZyMdZGBbGAZH8wSo8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784375495; c=relaxed/simple; bh=puskvRfJAlqS2JQQP5Fdxyq7utIPHjlRxpbqCYyxiNU=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=p/iq9LZwtPn9sDcr18Wx+/bjTw3NIwHG5D3X5me/K+r4bC1J6MNbOVm7dWNT/gcM6sJwz4u1dMs/WBRS9s5kvsG6q8aeVY4wInSM+yf0XtTOBM/g05bYdzTXORQo//L76+DqxdDXzMeit7x86O7mMCN0nZODVm+WG24oNitcWA0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=I40V3pyr; arc=none smtp.client-ip=74.125.225.137 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="I40V3pyr" Received: by mail-wm2-f9.google.com with SMTP id 5b1f17b1804b1-493e55619a2so19887345e9.1 for ; Sat, 18 Jul 2026 04:51:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784375492; x=1784980292; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=G/wgnKWNJl2PQ3MHBb+pT75nTWY+yYJVOgbAOO2hiXw=; b=I40V3pyrna5j2VApqP12vVUq3pjwE0Jo2eM8Rnge/vQw6fyy5YMpz/JU919kbibO9y SoQMu2qjLR9QEEPuDrwFI0Zi4+LS7w171vpi5utIFnThzwEmMgrlxW6gRyPxf1yt+W5L NiPkWDGB+CukQrcfK1EgO1VaYgSQ9bhxVTgu7tufAfqGTYq9d+N+nSn+oY1cNZUiY2N5 fKKulnX43cCgzWG0zNTVqgAoP1RJOfe0dYTcwrLlibDsHb3WmKPSSn1OmkkgkkkEZPqz 0S+gAg93nfTIhAdwhl1NF52MfU9Co0MMQHfGQKra1xwRfbjicWaV+kTDhMRq2/BsC3rl p6iw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784375492; x=1784980292; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=G/wgnKWNJl2PQ3MHBb+pT75nTWY+yYJVOgbAOO2hiXw=; b=isEghiDPaL0tP1TbY0vfXk6MmXjnm7+OqVXGDt+UxC82NIPijM7N0uazmoRmaG+h6b VmSYNZgGHsrySh0z1N7H8JH8URzGFU34bYd8PEJ5SlzbXE7KHcadcD34wp1savPSNnTv vjXbajcu7uNB00gqautBcJR8t34lW8D39oqOWODDu1LbVoJF2W0nHb+ezOr6dPC3U6gq m9r+CSaCy3Dp4mS5vKmWVPIgwRTA9hjxAm/Aba5hyxjin40UVapC5wm3ZMjbLS7im5qY /yCqTBkTafp9dkvFgZhJeLuGwKbe8zi+XCtyZWzI9hgTyGBl5Ca5czhqT7HCXOygHh4/ g5pQ== X-Forwarded-Encrypted: i=1; AHgh+Rpw4ZsK03eGYpyZhLbAmY2XcJyf2CRaQ3XOD4flTxvC4ADJcW/K1z/Jn3suCuns3xIuWZde9m7ueQqceWM=@vger.kernel.org X-Gm-Message-State: AOJu0YwIfKwZ165IqSBLDyQvoSGfspSdZugDThn/5ldE7Nce250yZK9S hCXFq80CuHOAyLpKcbXvl3edPnYGll39S4eUVptIa/EsLJbuqhpdwuzP X-Gm-Gg: AfdE7clsVV8vsab5xSJgUYXGRQ5XWl/0hoioWc/XEVCkwUYKHr8XusXUXSfs2+OZ24F Iw4uG7qF+dBvOEKviOCWgmlh0fzVvKiPUM5OZOxlW9L9mtOk1lQULmhwPtWnnOrSiB5QfrKmCo5 FhRb+d0SWl1YuTkEWPjsWDFtcswllze4XckewLZSGRpre2oincWccoDaAufonjYpVtekSuE5Hyj aewVPVmmtUOzFuOpxUZGSXaCo2aU7b7R7rosFt86LWVtI1j6eeNaCgPDKfcdXuQWORi4wBLuDaf dHlLZgUwHXFh9R0v5jr1O9YHOUgituVgpGTCmuSTe6e2Et9e4pn4GQu9OZOubz4zDgSkQmE72/S DAGKIj+yaVKOWL6w2p78cKxvtRGrmvSmOe9RGJ2qMjlMU7ok2c+fpnIsOknmMeivq57L007D/E2 TfotUPcORmF2Xkwh+WbaY= X-Received: by 2002:a05:600c:3590:b0:490:e5c1:b8b9 with SMTP id 5b1f17b1804b1-4954a8e3616mr72865385e9.0.1784375491599; Sat, 18 Jul 2026 04:51:31 -0700 (PDT) Received: from workstation.. ([202.163.123.30]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-495499f3f99sm112545925e9.0.2026.07.18.04.51.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 18 Jul 2026 04:51:31 -0700 (PDT) From: Ali Tariq To: Daire McNamara Cc: Ali Tariq , stable@vger.kernel.org, Lorenzo Pieralisi , =?UTF-8?q?Krzysztof=20Wilczy=C5=84ski?= , Manivannan Sadhasivam , Rob Herring , Bjorn Helgaas , Minda Chen , Mason Huo , linux-pci@vger.kernel.org (open list:PCI DRIVER FOR PLDA PCIE IP), linux-kernel@vger.kernel.org (open list) Subject: [PATCH] PCI: plda: Fix use-after-free of event IRQs during teardown Date: Sat, 18 Jul 2026 16:50:22 +0500 Message-Id: <20260718115022.231990-1-alitariq45892@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" plda_pcie_irq_domain_deinit() removes pcie->event_domain via irq_domain_remove(), but the per-event IRQs mapped from that domain are requested with devm_request_irq() in plda_init_interrupts(). The actual free_irq() for a devm-managed IRQ is deferred by devres until after the calling probe()/remove() function returns. This means irq_domain_remove() can free the domain's internal data before the deferred free_irq() for IRQs still mapped into it has run. When devres later processes that deferred cleanup, it can end up dereferencing the already-freed domain. Free each event IRQ explicitly with devm_free_irq() before removing the domain. This triggers the free immediately and removes the IRQ from the devres tracking list, so devres will not attempt to free it a second time later. This is a pre-existing issue, flagged by automated review during work on an earlier, unrelated patch to this driver. Build-tested and boot-tested on StarFive VisionFive v1.2A board Fixes: 76c911396807 ("PCI: plda: Add host init/deinit and map bus functions= ") Link: https://lore.kernel.org/linux-pci/20260714115343.4D49E1F000E9@smtp.ke= rnel.org/ Signed-off-by: Ali Tariq Cc: stable@vger.kernel.org --- drivers/pci/controller/plda/pcie-plda-host.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/pci/controller/plda/pcie-plda-host.c b/drivers/pci/con= troller/plda/pcie-plda-host.c index f9a34f323ad8..cda8fdb088fd 100644 --- a/drivers/pci/controller/plda/pcie-plda-host.c +++ b/drivers/pci/controller/plda/pcie-plda-host.c @@ -559,10 +559,18 @@ EXPORT_SYMBOL_GPL(plda_pcie_setup_iomems); =20 static void plda_pcie_irq_domain_deinit(struct plda_pcie_rp *pcie) { + u32 i, event_irq; + irq_set_chained_handler_and_data(pcie->irq, NULL, NULL); irq_set_chained_handler_and_data(pcie->msi_irq, NULL, NULL); irq_set_chained_handler_and_data(pcie->intx_irq, NULL, NULL); =20 + for_each_set_bit(i, &pcie->events_bitmap, pcie->num_events) { + event_irq =3D irq_find_mapping(pcie->event_domain, i); + if (event_irq) + devm_free_irq(pcie->dev, event_irq, pcie); + } + irq_domain_remove(pcie->msi.dev_domain); =20 irq_domain_remove(pcie->intx_domain); --=20 2.34.1