[PATCH] crypto: amcc - fix racy teardown with devm_request_irq

[Rosen Penev]

The driver uses devm_request_irq() for the IRQ, but cleans up the
tasklet and DMA rings inside the remove function.  Since devres frees
the IRQ only after the remove function returns, a window exists where a
pending hardware interrupt can reschedule the tasklet after it has been
killed, leading to use-after-free of the descriptor rings.

Fix by switching to plain request_irq() and adding the corresponding
free_irq() calls in the remove function and the probe error path before
tasklet_kill(), ensuring the IRQ is fully torn down before the tasklet
is killed.

Rename goto error path to err_tasklet as that's more descriptive.

Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@xxxxxxxxx>
---
 drivers/crypto/amcc/crypto4xx_core.c | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c
index 0271b5e4d923..fd010bfb7020 100644
--- a/drivers/crypto/amcc/crypto4xx_core.c
+++ b/drivers/crypto/amcc/crypto4xx_core.c
@@ -1294,14 +1294,14 @@ static int crypto4xx_probe(struct platform_device *ofdev)
 	core_dev->irq = platform_get_irq(ofdev, 0);
 	if (core_dev->irq < 0) {
 		rc = core_dev->irq;
-		goto err_iomap;
+		goto err_tasklet;
 	}
-	rc = devm_request_irq(&ofdev->dev, core_dev->irq,
-			      is_revb ? crypto4xx_ce_interrupt_handler_revb :
-					crypto4xx_ce_interrupt_handler,
-			      0, KBUILD_MODNAME, dev);
+	rc = request_irq(core_dev->irq,
+			 is_revb ? crypto4xx_ce_interrupt_handler_revb :
+				   crypto4xx_ce_interrupt_handler,
+			 0, KBUILD_MODNAME, dev);
 	if (rc)
-		goto err_iomap;
+		goto err_tasklet;
 
 	/* need to setup pdr, rdr, gdr and sdr before this */
 	crypto4xx_hw_init(core_dev->dev);
@@ -1310,12 +1310,14 @@ static int crypto4xx_probe(struct platform_device *ofdev)
 	rc = crypto4xx_register_alg(core_dev->dev, crypto4xx_alg,
 			       ARRAY_SIZE(crypto4xx_alg));
 	if (rc)
-		goto err_iomap;
+		goto err_irq;
 
 	ppc4xx_trng_probe(core_dev);
 	return 0;
 
-err_iomap:
+err_irq:
+	free_irq(core_dev->irq, dev);
+err_tasklet:
 	tasklet_kill(&core_dev->tasklet);
 err_build_sdr:
 	crypto4xx_destroy_sdr(core_dev->dev);
@@ -1331,6 +1333,11 @@ static void crypto4xx_remove(struct platform_device *ofdev)
 
 	ppc4xx_trng_remove(core_dev);
 
+	/*
+	 * Free IRQ before killing the tasklet to prevent the interrupt
+	 * handler from rescheduling the tasklet after it has been killed.
+	 */
+	free_irq(core_dev->irq, dev);
 	tasklet_kill(&core_dev->tasklet);
 	/* Un-register with Linux CryptoAPI */
 	crypto4xx_unregister_alg(core_dev->dev);
-- 
2.55.0