CVE-2026-89455: PCI: plda: Fix use-after-free of event IRQs during teardown
In the Linux kernel, the following vulnerability has been resolved:
PCI: plda: Fix use-after-free of event IRQs during teardown
pldapcieirqdomaindeinit() removes pcie->eventdomain via irqdomainremove(), but the per-event IRQs mapped from that domain are requested with devmrequestirq() in pldainitinterrupts(). The actual freeirq() for a devm-managed IRQ is deferred by devres until after the calling probe()/remove() function returns.
This means irqdomainremove() can free the domain's internal data before the deferred freeirq() for IRQs still mapped into it has run. When devres later processes that deferred cleanup, it can end up dereferencing the already-freed domain.
Free each event IRQ explicitly with devmfreeirq() before removing the domain. This triggers the free immediately and removes the IRQ from the devres tracking list, so devres will not attempt to free it a second time later.
Also dispose of the event, INTx, and MSI IRQ mappings with irqdisposemapping() before their owning domains are removed.
Finally, guard the calls to irqsetchainedhandleranddata() for pcie->irq, pcie->msiirq, and pcie->intxirq so they only run when those fields hold a valid (>0) IRQ number.
This is a pre-existing issue, flagged by automated review during work on an earlier, unrelated patch to this driver.
Build-tested and boot-tested on StarFive VisionFive v1.2A board
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Guard the calls to irq_set_chained_handler_and_data() so they only run when plda_pcie_irq_domain_deinit() removes pcie->event_domain via the domain.
Linux kernel PCI: plda (IRQ teardown path) guard irq_set_chained_handler_and_data() calls = only run when plda_pcie_irq_domain_deinit() is removing pcie->event_domain via irq_domain_remove() - Configuration
Guard pcie->irq, pcie->msi_irq, and pcie->intx_irq so that teardown logic only runs when plda_pcie_irq_domain_deinit() removes pcie->event_domain via the domain (only for fields holding valid (>0) IRQ numbers).
Linux kernel PCI: plda (interrupt teardown fields) IRQ mapping teardown conditions for pcie->irq / pcie->msi_irq / pcie->intx_irq = >0 valid IRQ numbers - Operational
In plda teardown, dispose of the event, INTx, and MSI IRQ mappings (i.e., ensure irq_domain_remove()/mapping teardown does not leave stale mappings) as part of the teardown sequence.
- Operational
Explicitly free each event IRQ with devm_free_irq() before removing the IRQ domain, so devres deferred cleanup will not later attempt to free an already-freed IRQ/domain mapping.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel PLDA PCIe driver are exposed when its teardown path handles event IRQs and removes the associated IRQ domain. The issue concerns driver removal or teardown rather than normal operation described in the available data.
What triggers the use-after-free condition?
The condition occurs when irq_domain_remove() frees the event IRQ domain before devres performs its deferred cleanup of IRQs requested with devm_request_irq(). That later cleanup can dereference the domain after it has already been freed.
What is the relevant mitigation if an updated kernel is not immediately available?
The provided fix explicitly frees each event IRQ with devm_free_irq() before removing the event domain, then disposes event, INTx, and MSI IRQ mappings before their owning domains are removed. It also guards chained IRQ-handler setup so it runs only for valid IRQ values greater than zero.