From 82aa033fef523ab4f0165afbc1c1fb0dadb89f94 Mon Sep 17 00:00:00 2001 From: Pengpeng Hou Date: Tue, 16 Jun 2026 23:10:28 +0800 Subject: [PATCH] misc: rp1: clear chained IRQ handlers on teardown rp1_probe() installs a chained handler for each parent MSI-X vector and stores the rp1 device pointer as handler data. rp1_unregister_interrupts() then disposes the child IRQ mappings, removes the IRQ domain, and frees the PCI IRQ vectors without first removing those chained handlers. If a teardown path runs after the handlers have been installed, a later parent IRQ can still call rp1_chained_handle_irq() with stale handler data and a removed IRQ domain. Clear the chained handlers before disposing mappings and freeing the vectors. Signed-off-by: Pengpeng Hou Reviewed-by: Andrea della Porta Link: https://patch.msgid.link/20260616151028.69890-1-pengpeng@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman --- drivers/misc/rp1/rp1_pci.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/misc/rp1/rp1_pci.c b/drivers/misc/rp1/rp1_pci.c index 81685e3f3296..a1f20d88be5d 100644 --- a/drivers/misc/rp1/rp1_pci.c +++ b/drivers/misc/rp1/rp1_pci.c @@ -166,6 +166,9 @@ static void rp1_unregister_interrupts(struct pci_dev *pdev) struct rp1_dev *rp1 = pci_get_drvdata(pdev); int irq, i; + for (i = 0; i < RP1_INT_END; i++) + irq_set_chained_handler_and_data(pci_irq_vector(pdev, i), NULL, NULL); + if (rp1->domain) { for (i = 0; i < RP1_INT_END; i++) { irq = irq_find_mapping(rp1->domain, i);