From nobody Fri Oct 2 14:02:52 2026 Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9DBE8474254 for ; Thu, 30 Jul 2026 23:16:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785453367; cv=none; b=sJbp1NeFTzSst32fZtCu3lar6q0i3dReamh19Ulfn6/0JbGUUgpr7dSG8vbEoGXUvHIKBu/iNVJdplmlzVvY9dh8MPcMeMw9vksmj7Hj4UoBa/4mHBXKEDK4DlaE7+y5NMuyHTDkWDF2H4AHYsBVhRJ8PwNKUSdj5H3qhQPP4CY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785453367; c=relaxed/simple; bh=k46R8NV4nzCJkUeBxInNMx2ShBB/ei4eKa4a7/1hpYk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=tX2FhG6YxtmS0YzCbyPKe1F5HbWjoLzIYpJJpOaE5npX2m8mCB1Jztkg2CuJGYTfFlvU255VGepMi7RBCC99hqB9AkRDLv1wgNAnzIHrH+ehgGdvEz9B/6W9e93DtDYwze3TSjBuGdaNtkLHdQUquK6L/PGZXBXpVF8X3b9P8uM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Q0zx2bNU; arc=none smtp.client-ip=209.85.214.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Q0zx2bNU" Received: by mail-pl1-f173.google.com with SMTP id d9443c01a7336-2cacf197759so4573445ad.2 for ; Thu, 30 Jul 2026 16:16:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785453366; x=1786058166; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=sscADE7cqna/tqNzcv4rEvOR2epXbUMsFulPTJ1FF2o=; b=Q0zx2bNURV+ODh1eMxsy400+uVCqcHyY4PuMgrXw0VFn8nr61yXL0VMbOP2A0ti90G dzSkO3k3YyTR3OeHlvthOY4KWZwY7wl1U6KTk/pCoS14crYvihHBI6id3O1yAt+Jau7+ 86CYI9sqoTu8g3j4F/iOkz/sC6aH4IPAd+6GyWwMzo8d9dGxkHdJVizhNbnbKXxL9V4e UzQ3OdxOh7RbLVYSbxIwAnqiXXtUDxIv127fd/SgfUpxO3q15xmeOKLTKim/IwHMWK7O ktyQvAMouSBQOe0Ey+sn/QkKH4HgKPU+FSM1c0I+wNRP55g6P5rnb2EgcOVZxEZ6mrM4 X/ag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785453366; x=1786058166; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=sscADE7cqna/tqNzcv4rEvOR2epXbUMsFulPTJ1FF2o=; b=XsmrvgQTpR2mRGNyIL1FoyYe9oMoHTm2GwGT/w9O9Do3RP8bUivVJP1K3pXw5qpS+W 0tTj8E2Gehscx1mljfy752/6Gjs0Wws3FNqGIQZ/j7fXHP2D8ek1y8fVwa5HJdOm2uGZ Jm8UyVgMyFJ2fjbQvtm2LS0l/OopE9Da2rS2kqm6q1THrEgNJPpOBs23fDS7gMHBBdjY hluCcuEAKyZ+Y077POemjDaO2qZzjelu/iDBFYuq4Jq9GiVthgEFnV/DMilzXmPwUGj8 dzBRIQNa6F2spSvqTRxMg2LDSubBVwWKh7g/WCswEqhrNERuzKMZjHX2EGf+UJpKXdT/ W8yQ== X-Forwarded-Encrypted: i=1; AHgh+RqoDr8P39uiGWe3ntyNR9JLJC89AUkwhshLj82/cZ1s1ClKN25OQBzBE9Zr1i+gc5ORfxnnGwRbKQXLCxw=@vger.kernel.org X-Gm-Message-State: AOJu0YxK9FwuQ57WlL6mUCJCr0b/cJ/CX0OwHSFBjPH9pc3QIjwkRrku Xreci8I9Xgoxk0zBURRSoXln3g0Y36SEGRhvQYnlWhLzkRhhyoqs1h9W X-Gm-Gg: AR+sD11NYVv/V5E2SUsLRqBBuzQLjZFPPVVqHmwSj37moecZtSLjmvwxuGCqbDMls0R BKbcFpy+Of2nynaLXL/7Q8IQrqEjOCAV/JId6ag2XbImq4uGoJAkC2x5e5dS13TSJOLY81rJ2re FFwlM5BhsMg8OYUxeReE+BsO9c209BRUt701LKoqnUg3+Fj9qKDw++XQFhEHeRlwgJKFFECEB/l InhmXZGbUN9qg+CGjwlh0OJqK2aOji0GTWL9HrkPNEyK+faeUm0RyXhhHuOWeEbordAg0AalCXH H9aUnjdIKOtrfDXKQlOs8rTYepcWQ4TVQXn7G7z2dPECMF18q7knFXs9D3xY4w0zRpETW2hvXFu b32n138kRDWts+BH5wOMNHKP0SZ+B8KVT5hizaBYOsOSPU1h1eeNL0pGqDXkTnG1S27TnA9oRWV TCVnPlmwEL54isH7myONTz2IY0oEDMtZqeVkGLinxSbTg0iJQxfcothh2P2A7f5oxa22LUdgw/K yS9Jgq/0VK0nu+l8WJMW4FioeOhi1b5UUN3tRrMQlUP6LYlzzNWRTu5R/4XIju4dc1VXOusehXd Rj7CWtmAywA3ZPxiJtlG2Y0UqqpCnn2Jim4NLw== X-Received: by 2002:a17:903:28e:b0:2c8:1c05:16aa with SMTP id d9443c01a7336-2d035be9bb3mr41081165ad.19.1785453365759; Thu, 30 Jul 2026 16:16:05 -0700 (PDT) Received: from ryzen.lan ([2601:644:8000:7a86::e35]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d022c55a7dsm32517265ad.84.2026.07.30.16.16.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 30 Jul 2026 16:16:04 -0700 (PDT) From: Rosen Penev To: linux-crypto@vger.kernel.org Cc: =?UTF-8?q?Horia=20Geant=C4=83?= , Pankaj Gupta , Gaurav Jain , Herbert Xu , "David S. Miller" , linux-kernel@vger.kernel.org (open list) Subject: [PATCH] crypto: caam/jr: fix use-after-free in interrupt handler teardown Date: Thu, 30 Jul 2026 16:16:03 -0700 Message-ID: <20260730231603.1169539-1-rosenp@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" caam_jr_shutdown() currently calls tasklet_kill() without freeing the IRQ first, creating a window where the interrupt handler can fire and schedule the tasklet after it has been killed. Move from devm_request_irq() to request_irq()/free_irq() so that the IRQ is explicitly freed in caam_jr_shutdown() before the tasklet is killed. As part of this change, pass jrp directly as the dev_id cookie to request_irq() instead of the device pointer. This lets the interrupt handler obtain jrp directly from the cookie, eliminating the dev_get_drvdata() call in the hot path. Two related fixes: - Use jrp->dev instead of the now-undefined dev local in the handler's error path. - Set jrpriv->dev before calling caam_jr_init() so that jrp->dev is valid before the IRQ is registered and the handler can run. Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev --- drivers/crypto/caam/jr.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/crypto/caam/jr.c b/drivers/crypto/caam/jr.c index bddeaaaca487..b577c6a2e4aa 100644 --- a/drivers/crypto/caam/jr.c +++ b/drivers/crypto/caam/jr.c @@ -173,6 +173,7 @@ static int caam_jr_shutdown(struct device *dev) =20 ret =3D caam_reset_hw_jr(dev); =20 + free_irq(jrp->irq, jrp); tasklet_kill(&jrp->irqtask); =20 return ret; @@ -218,8 +219,7 @@ static void caam_jr_remove(struct platform_device *pdev) /* Main per-ring interrupt handler */ static irqreturn_t caam_jr_interrupt(int irq, void *st_dev) { - struct device *dev =3D st_dev; - struct caam_drv_private_jr *jrp =3D dev_get_drvdata(dev); + struct caam_drv_private_jr *jrp =3D st_dev; u32 irqstate; =20 /* @@ -236,7 +236,7 @@ static irqreturn_t caam_jr_interrupt(int irq, void *st_= dev) * restart the queue (and fix code). */ if (irqstate & JRINT_JR_ERROR) { - dev_err(dev, "job ring error: irqstate: %08x\n", irqstate); + dev_err(jrp->dev, "job ring error: irqstate: %08x\n", irqstate); BUG(); } =20 @@ -563,8 +563,8 @@ static int caam_jr_init(struct device *dev) (unsigned long)&jrp->tasklet_params); =20 /* Connect job ring interrupt handler. */ - error =3D devm_request_irq(dev, jrp->irq, caam_jr_interrupt, IRQF_SHARED, - dev_name(dev), dev); + error =3D request_irq(jrp->irq, caam_jr_interrupt, IRQF_SHARED, + dev_name(dev), jrp); if (error) { dev_err(dev, "can't connect JobR %d interrupt (%d)\n", jrp->ridx, jrp->irq); @@ -658,12 +658,12 @@ static int caam_jr_probe(struct platform_device *pdev) if (error) return error; =20 + jrpriv->dev =3D jrdev; + /* Now do the platform independent part */ error =3D caam_jr_init(jrdev); /* now turn on hardware */ if (error) return error; - - jrpriv->dev =3D jrdev; spin_lock(&driver_data.jr_alloc_lock); list_add_tail(&jrpriv->list_node, &driver_data.jr_list); spin_unlock(&driver_data.jr_alloc_lock); --=20 2.55.0