mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 10:31:33 -04:00
Code Issues Packages Projects Releases Wiki Activity

crypto: amcc - fix racy teardown with devm_request_irq

Browse Source 
The driver uses devm_request_irq() for the IRQ, but cleans up the
tasklet and DMA rings inside the remove function.  Since devres frees
the IRQ only after the remove function returns, a window exists where a
pending hardware interrupt can reschedule the tasklet after it has been
killed, leading to use-after-free of the descriptor rings.

Fix by switching to plain request_irq() and adding the corresponding
free_irq() calls in the remove function and the probe error path before
tasklet_kill(), ensuring the IRQ is fully torn down before the tasklet
is killed.

Rename goto error path to err_tasklet as that's more descriptive.

Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
Rosen Penev
2026-07-30 12:14:20 -07:00
committed by Herbert Xu
parent e5658c6041
commit aacf3a6c47
1 changed files with 15 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
drivers/crypto/amcc/crypto4xx_core.c
View File

@@ -1294,14 +1294,14 @@ static int crypto4xx_probe(struct platform_device *ofdev)
core_dev->irq = platform_get_irq(ofdev, 0);
if (core_dev->irq < 0) {
rc = core_dev->irq;
goto err_iomap;
goto err_tasklet;
}
rc = devm_request_irq(&ofdev->dev, core_dev->irq,
is_revb ? crypto4xx_ce_interrupt_handler_revb :
crypto4xx_ce_interrupt_handler,
0, KBUILD_MODNAME, dev);
rc = request_irq(core_dev->irq,
is_revb ? crypto4xx_ce_interrupt_handler_revb :
crypto4xx_ce_interrupt_handler,
0, KBUILD_MODNAME, dev);
if (rc)
goto err_iomap;
goto err_tasklet;
/* need to setup pdr, rdr, gdr and sdr before this */
crypto4xx_hw_init(core_dev->dev);
@@ -1310,12 +1310,14 @@ static int crypto4xx_probe(struct platform_device *ofdev)
rc = crypto4xx_register_alg(core_dev->dev, crypto4xx_alg,
ARRAY_SIZE(crypto4xx_alg));
if (rc)
goto err_iomap;
goto err_irq;
ppc4xx_trng_probe(core_dev);
return 0;
err_iomap:
err_irq:
free_irq(core_dev->irq, dev);
err_tasklet:
tasklet_kill(&core_dev->tasklet);
err_build_sdr:
crypto4xx_destroy_sdr(core_dev->dev);
@@ -1331,6 +1333,11 @@ static void crypto4xx_remove(struct platform_device *ofdev)
ppc4xx_trng_remove(core_dev);
/*
* Free IRQ before killing the tasklet to prevent the interrupt
* handler from rescheduling the tasklet after it has been killed.
*/
free_irq(core_dev->irq, dev);
tasklet_kill(&core_dev->tasklet);
/* Un-register with Linux CryptoAPI */
crypto4xx_unregister_alg(core_dev->dev);