Re: [PATCH] crypto: amcc - fix racy teardown with devm_request_irq

[Herbert Xu]

On Thu, Jul 30, 2026 at 12:14:20PM -0700, Rosen Penev wrote:
> The driver uses devm_request_irq() for the IRQ, but cleans up the
> tasklet and DMA rings inside the remove function.  Since devres frees
> the IRQ only after the remove function returns, a window exists where a
> pending hardware interrupt can reschedule the tasklet after it has been
> killed, leading to use-after-free of the descriptor rings.
> 
> Fix by switching to plain request_irq() and adding the corresponding
> free_irq() calls in the remove function and the probe error path before
> tasklet_kill(), ensuring the IRQ is fully torn down before the tasklet
> is killed.
> 
> Rename goto error path to err_tasklet as that's more descriptive.
> 
> Assisted-by: opencode:big-pickle
> Signed-off-by: Rosen Penev <rosenp@xxxxxxxxx>
> ---
>  drivers/crypto/amcc/crypto4xx_core.c | 23 +++++++++++++++--------
>  1 file changed, 15 insertions(+), 8 deletions(-)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt