[PATCH v7 08/10] irqchip/imx-irqsteer: Dispose of child IRQ mappings in remove()

[Radu Rendec]

On Wed, 2026-11-04 at 16:37 +0900, Zhipeng.wang_1 at oss.nxp.com wrote:
> From: Zhipeng Wang <zhipeng.wang_1 at nxp.com>
> 
> Once the driver can be unloaded, the IRQ domain mappings handed out to
> downstream consumers must be released on remove(), otherwise:
> 
>  - a parent interrupt racing with the teardown can run the chained
>    handler while irqsteer_data is freed (no synchronize_irq());
>  - downstream irq_descs keep dangling chip pointers into the unloaded
>    module.
> 
> Dispose of every child hwirq mapping in remove(). irq_dispose_mapping()
> calls irq_domain_disassociate(), which runs synchronize_irq() and frees
> the descriptor, closing both races.
> 
> Signed-off-by: Zhipeng Wang <zhipeng.wang_1 at nxp.com>
> ---
>  drivers/irqchip/irq-imx-irqsteer.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/irqchip/irq-imx-irqsteer.c b/drivers/irqchip/irq-imx-irqsteer.c
> index a14a8b80d60e..d15b806b278c 100644
> --- a/drivers/irqchip/irq-imx-irqsteer.c
> +++ b/drivers/irqchip/irq-imx-irqsteer.c
> @@ -272,6 +272,7 @@ static int imx_irqsteer_probe(struct platform_device *pdev)
>  static void imx_irqsteer_remove(struct platform_device *pdev)
>  {
>  	struct irqsteer_data *irqsteer_data = platform_get_drvdata(pdev);
> +	unsigned int hwirq;
>  	int i, ret;
>  
>  	/*
> @@ -294,6 +295,9 @@ static void imx_irqsteer_remove(struct platform_device *pdev)
>  		irq_dispose_mapping(irqsteer_data->irq[i]);
>  	}
>  
> +	for (hwirq = 0; hwirq < irqsteer_data->reg_num * 32; hwirq++)
> +		irq_dispose_mapping(irq_find_mapping(irqsteer_data->domain, hwirq));
> +
>  	irq_domain_remove(irqsteer_data->domain);
>  
>  	if (ret >= 0)

Reviewed-by: Radu Rendec <radu at rendec.net>