crypto: amcc - fix racy teardown with devm_request_irq

Browse source

The driver uses devm_request_irq() for the IRQ, but cleans up the
tasklet and DMA rings inside the remove function.  Since devres frees
the IRQ only after the remove function returns, a window exists where a
pending hardware interrupt can reschedule the tasklet after it has been
killed, leading to use-after-free of the descriptor rings.

Fix by switching to plain request_irq() and adding the corresponding
free_irq() calls in the remove function and the probe error path before
tasklet_kill(), ensuring the IRQ is fully torn down before the tasklet
is killed.

Rename goto error path to err_tasklet as that's more descriptive.

Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

...

This commit is contained in:

Rosen Penev 2026-07-30 12:14:20 -07:00 • committed by Herbert Xu

parent e5658c6041

commit aacf3a6c47

1 changed files with 15 additions and 8 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

23

drivers/crypto/amcc/crypto4xx_core.c

View file