Linux Kernel ImgTec PDC IRQ Chip Driver Resource Leak Vulnerability

A resource leak vulnerability has been identified in the Linux kernel's ImgTec PDC IRQ chip driver. When the driver is removed, it fails to free allocated generic interrupt chips and does not clear installed chained handlers. This oversight leaves dangling references that can be accessed by interrupt chip callbacks, potentially causing a use-after-free condition and leading to a kernel crash. Additionally, the residual chained handlers for peripheral and syswake interrupts can trigger spurious interrupts that access freed memory.

Impact

The vulnerability can be exploited to create a use-after-free condition, causing a kernel crash. However, such use-after-free vulnerabilities can often be exploited to execute arbitrary code in the kernel context.

Reproduction

To reproduce this vulnerability, load the ImgTec PDC IRQ chip driver, which allocates generic interrupt chips and sets up chained handlers for peripheral and syswake interrupts. After the driver has been loaded, remove it. The driver removal process will not free the allocated generic chips or remove the chained handlers, leaving behind dangling references that can be accessed by interrupt chip callbacks. This sequence can be repeated to consistently reproduce the issue.

Remediation

The vulnerability has been addressed by modifying the driver to set the IRQ_DOMAIN_FLAG_DESTROY_GC flag, ensuring that generic chips are automatically removed when the IRQ domain is deleted. Additionally, the driver now clears all chained handlers before removing the IRQ domain, preventing any residual references from causing issues.