irqchip/gic-v3-its: Free collection mapping on device teardown

We allocate the collection mapping on device creation, but somehow
free it on the irqdomain free path, which is pretty inconsistent
and has led to bugs in the past.

Move it to the point where we teardown the device, making the
alloc/free symetric.

Signed-off-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Zenghui Yu <yuzenghui@huawei.com>
Link: https://lore.kernel.org/r/20191108165805.3071-2-maz@kernel.org

diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 021e0c70e87c02feb00f74e4e3ae9b6d7b595824..d5d8f8fc097396399bd2f1c85792eb067f41b9b1 100644 (file)
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -2474,6 +2474,7 @@ static void its_free_device(struct its_device *its_dev)
        raw_spin_lock_irqsave(&its_dev->its->lock, flags);
        list_del(&its_dev->entry);
        raw_spin_unlock_irqrestore(&its_dev->its->lock, flags);
+       kfree(its_dev->event_map.col_map);
        kfree(its_dev->itt);
        kfree(its_dev);
 }
@@ -2682,7 +2683,6 @@ static void its_irq_domain_free(struct irq_domain *domain, unsigned int virq,
                its_lpi_free(its_dev->event_map.lpi_map,
                             its_dev->event_map.lpi_base,
                             its_dev->event_map.nr_lpis);
-               kfree(its_dev->event_map.col_map);
 
                /* Unmap device/itt */
                its_send_mapd(its_dev, 0);