irq_alloc_domain_generic_chips() stores the allocated generic chip
data in domain->gc. On the error path taken when irq_of_parse_and_map()
fails, ingenic_tcu_irq_init() calls irq_domain_remove() without first
calling irq_domain_remove_generic_chips(). As the domain was created
with irq_domain_add_linear(), which does not set
IRQ_DOMAIN_FLAG_DESTROY_GC, irq_domain_remove() never frees the generic
chips and the allocation leaks.

Call irq_domain_remove_generic_chips() before irq_domain_remove() so
that the generic chip data is released on the error path.

Fixes: 9536eba03ec7 ("irqchip: Add irq-ingenic-tcu driver")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
---
 drivers/irqchip/irq-ingenic-tcu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/irqchip/irq-ingenic-tcu.c b/drivers/irqchip/irq-ingenic-tcu.c
index 794ecba717c9..637fd90d97aa 100644
--- a/drivers/irqchip/irq-ingenic-tcu.c
+++ b/drivers/irqchip/irq-ingenic-tcu.c
@@ -171,6 +171,7 @@ static int __init ingenic_tcu_irq_init(struct device_node *np,
 	for (; i > 0; i--)
 		irq_dispose_mapping(tcu->parent_irqs[i - 1]);
 out_domain_remove:
+	irq_domain_remove_generic_chips(tcu->domain);
 	irq_domain_remove(tcu->domain);
 err_free_tcu:
 	kfree(tcu);
-- 
2.43.0

On Tue, Aug 18 2026 at 11:02, Haotian Zhang wrote:
> irq_alloc_domain_generic_chips() stores the allocated generic chip
> data in domain->gc. On the error path taken when irq_of_parse_and_map()
> fails, ingenic_tcu_irq_init() calls irq_domain_remove() without first
> calling irq_domain_remove_generic_chips(). As the domain was created
> with irq_domain_add_linear(), which does not set
> IRQ_DOMAIN_FLAG_DESTROY_GC, irq_domain_remove() never frees the generic
> chips and the allocation leaks.
>
> Call irq_domain_remove_generic_chips() before irq_domain_remove() so
> that the generic chip data is released on the error path.

No. Set the stupid flag on the domain and let the core code do it.