mv_cesa_remove() unregisters the algorithms and frees the IRQs but never
drains the engine queues. Each engine can still hold outstanding requests
in three places: engine->req (currently in flight), engine->queue (queued
but not started), and engine->complete_queue (processed but not yet
reported). The latter two are only completed from the IRQ handler, which
is torn down before they are flushed.

If the device is unbound via sysfs while requests are outstanding, those
waiters never receive their completion callback and block indefinitely,
leaking the request and its scatterlist buffers.

Drain all three queues in mv_cesa_remove() and complete each remaining
request with -ENOENT before freeing the IRQ, so bound tasks are released.

Assisted-by: LLM
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 drivers/crypto/marvell/cesa/cesa.c | 46 ++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/drivers/crypto/marvell/cesa/cesa.c b/drivers/crypto/marvell/cesa/cesa.c
index 564b09773507..25a30deca4c5 100644
--- a/drivers/crypto/marvell/cesa/cesa.c
+++ b/drivers/crypto/marvell/cesa/cesa.c
@@ -546,6 +546,52 @@ static void mv_cesa_remove(struct platform_device *pdev)
 	mv_cesa_remove_algs(cesa);
 
 	cesa_dev = NULL;
+
+	for (int i = 0; i < cesa->caps->nengines; i++) {
+		struct mv_cesa_engine *engine = &cesa->engines[i];
+		struct crypto_async_request *req;
+
+		/*
+		 * Stop the engine before releasing resources so it no longer
+		 * issues DMA to the SRAM region or to request scatterlists
+		 * that are about to be unmapped.
+		 */
+		writel(0, engine->regs + CESA_SA_INT_MSK);
+		writel(0, engine->regs + CESA_SA_CMD);
+		writel(0, engine->regs + CESA_TDMA_CONTROL);
+
+		spin_lock_bh(&engine->lock);
+		/*
+		 * Complete the request currently in flight and drain the
+		 * pending and already-processed queues with an error so that
+		 * waiters do not block indefinitely when the device is unbound
+		 * while requests are still outstanding.
+		 */
+		if (engine->req) {
+			req = engine->req;
+			engine->req = NULL;
+			spin_unlock_bh(&engine->lock);
+			mv_cesa_complete_req(crypto_tfm_ctx(req->tfm), req,
+					     -ENOENT);
+			spin_lock_bh(&engine->lock);
+		}
+
+		while ((req = crypto_dequeue_request(&engine->queue)) != NULL) {
+			spin_unlock_bh(&engine->lock);
+			mv_cesa_complete_req(crypto_tfm_ctx(req->tfm), req,
+					     -ENOENT);
+			spin_lock_bh(&engine->lock);
+		}
+
+		while ((req = mv_cesa_engine_dequeue_complete_request(engine))
+		       != NULL) {
+			spin_unlock_bh(&engine->lock);
+			mv_cesa_complete_req(crypto_tfm_ctx(req->tfm), req,
+					     -ENOENT);
+			spin_lock_bh(&engine->lock);
+		}
+		spin_unlock_bh(&engine->lock);
+	}
 }
 
 static const struct platform_device_id mv_cesa_plat_id_table[] = {
-- 
2.55.0

On Wed, Sep 16, 2026 at 04:05:26PM -0700, Rosen Penev wrote:
> mv_cesa_remove() unregisters the algorithms and frees the IRQs but never
> drains the engine queues. Each engine can still hold outstanding requests
> in three places: engine->req (currently in flight), engine->queue (queued
> but not started), and engine->complete_queue (processed but not yet
> reported). The latter two are only completed from the IRQ handler, which
> is torn down before they are flushed.
> 
> If the device is unbound via sysfs while requests are outstanding, those
> waiters never receive their completion callback and block indefinitely,
> leaking the request and its scatterlist buffers.
> 
> Drain all three queues in mv_cesa_remove() and complete each remaining
> request with -ENOENT before freeing the IRQ, so bound tasks are released.
> 
> Assisted-by: LLM
> Signed-off-by: Rosen Penev <rosenp@gmail.com>
> ---
>  drivers/crypto/marvell/cesa/cesa.c | 46 ++++++++++++++++++++++++++++++
>  1 file changed, 46 insertions(+)

Please check the Sashiko comments:

https://sashiko.dev/#/patchset/20260916230526.284982-1-rosenp%40gmail.com

Thanks,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt