In sdv_register_irqsupport(), if irq_domain_create_legacy() fails during device probing, a generic IRQ chip is left registered in the global gc_list while its underlying memory is freed, leading to a use-after-free. Use the managed variant of irq_setup_generic_chip() to ensure that the chip gets unregistered before the memory it uses is freed. Cc: stable@vger.kernel.org Fixes: 9381fc5d655d ("gpio: sodaville: Convert to use managed functions pcim_* and devm_*") Closes: https://sashiko.dev/#/bug/linux-2f7ac8b6-5034-4ff1-9afa-5700ff44e3e9 Signed-off-by: Bartosz Golaszewski --- drivers/gpio/gpio-sodaville.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/gpio/gpio-sodaville.c b/drivers/gpio/gpio-sodaville.c index e2a784df275c98699dd625c48f14a3be31113920..4ae38d964bfc1f4191ebebaf4716d544183a9e8e 100644 --- a/drivers/gpio/gpio-sodaville.c +++ b/drivers/gpio/gpio-sodaville.c @@ -166,9 +166,12 @@ static int sdv_register_irqsupport(struct sdv_gpio_chip_data *sd, ct->chip.irq_eoi = irq_gc_eoi; ct->chip.irq_set_type = sdv_gpio_pub_set_type; - irq_setup_generic_chip(sd->gc, IRQ_MSK(SDV_NUM_PUB_GPIOS), - IRQ_GC_INIT_MASK_CACHE, IRQ_NOREQUEST, - IRQ_LEVEL | IRQ_NOPROBE); + ret = devm_irq_setup_generic_chip(&pdev->dev, sd->gc, + IRQ_MSK(SDV_NUM_PUB_GPIOS), + IRQ_GC_INIT_MASK_CACHE, IRQ_NOREQUEST, + IRQ_LEVEL | IRQ_NOPROBE); + if (ret) + return ret; sd->id = irq_domain_create_legacy(dev_fwnode(&pdev->dev), SDV_NUM_PUB_GPIOS, sd->irq_base, 0, &irq_domain_sdv_ops, sd); --- base-commit: 8b7179210b22f8e48a82c5ceacb9d56a9c4cfec4 change-id: 20261105-gpio-sodaville-use-after-free-0824e74ebe18 Best regards, -- Bartosz Golaszewski