On PCI devices using MSI-X, ccp5_irq_handler() disables the queue
interrupts and schedules ccp->irq_tasklet. The tasklet calls
ccp5_irq_bh(), which accesses registers and wait queues through
ccp->cmd_q.

Both the ccp5_init() error path and ccp5_destroy() free the CCP IRQ
before the command queues and the device-managed ccp allocation are
released. sp_free_ccp_irq() prevents another hard IRQ and waits for an
in-flight handler, but it does not drain a tasklet that the handler
already scheduled. The tasklet can therefore access ccp->cmd_q after
its backing allocation has been released.

Kill the tasklet after sp_free_ccp_irq(), when no handler can schedule
it again, and before the command queues or ccp can be released. Check
ccp->use_tasklet because the tasklet is initialized only for MSI-X.

Fixes: 6263b51eb319 ("crypto: ccp - Change ISR handler method for a v5 CCP")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/crypto/ccp/ccp-dev-v5.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/crypto/ccp/ccp-dev-v5.c b/drivers/crypto/ccp/ccp-dev-v5.c
index dcd6aab51e47..dacde9614e8a 100644
--- a/drivers/crypto/ccp/ccp-dev-v5.c
+++ b/drivers/crypto/ccp/ccp-dev-v5.c
@@ -995,6 +995,8 @@ static int ccp5_init(struct ccp_device *ccp)
 
 e_irq:
 	sp_free_ccp_irq(ccp->sp, ccp);
+	if (ccp->use_tasklet)
+		tasklet_kill(&ccp->irq_tasklet);
 
 e_pool:
 	for (i = 0; i < ccp->cmd_q_count; i++)
@@ -1046,6 +1048,8 @@ static void ccp5_destroy(struct ccp_device *ccp)
 			kthread_stop(ccp->cmd_q[i].kthread);
 
 	sp_free_ccp_irq(ccp->sp, ccp);
+	if (ccp->use_tasklet)
+		tasklet_kill(&ccp->irq_tasklet);
 
 	/* Flush the cmd and backlog queue */
 	while (!list_empty(&ccp->cmd)) {
-- 
2.34.1

Patched in https://lore.kernel.org/all/arOUsmw2dweuSVzq@gondor.apana.org.au/
ignore this, sorry.



At 2026-09-24 17:05:37, "Jiale Yao" <yaojiale02@163.com> wrote:
>On PCI devices using MSI-X, ccp5_irq_handler() disables the queue
>interrupts and schedules ccp->irq_tasklet. The tasklet calls
>ccp5_irq_bh(), which accesses registers and wait queues through
>ccp->cmd_q.
>
>Both the ccp5_init() error path and ccp5_destroy() free the CCP IRQ
>before the command queues and the device-managed ccp allocation are
>released. sp_free_ccp_irq() prevents another hard IRQ and waits for an
>in-flight handler, but it does not drain a tasklet that the handler
>already scheduled. The tasklet can therefore access ccp->cmd_q after
>its backing allocation has been released.
>
>Kill the tasklet after sp_free_ccp_irq(), when no handler can schedule
>it again, and before the command queues or ccp can be released. Check
>ccp->use_tasklet because the tasklet is initialized only for MSI-X.
>
>Fixes: 6263b51eb319 ("crypto: ccp - Change ISR handler method for a v5 CCP")
>Cc: stable@vger.kernel.org
>Signed-off-by: Jiale Yao <yaojiale02@163.com>
>---
> drivers/crypto/ccp/ccp-dev-v5.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
>diff --git a/drivers/crypto/ccp/ccp-dev-v5.c b/drivers/crypto/ccp/ccp-dev-v5.c
>index dcd6aab51e47..dacde9614e8a 100644
>--- a/drivers/crypto/ccp/ccp-dev-v5.c
>+++ b/drivers/crypto/ccp/ccp-dev-v5.c
>@@ -995,6 +995,8 @@ static int ccp5_init(struct ccp_device *ccp)
> 
> e_irq:
> 	sp_free_ccp_irq(ccp->sp, ccp);
>+	if (ccp->use_tasklet)
>+		tasklet_kill(&ccp->irq_tasklet);
> 
> e_pool:
> 	for (i = 0; i < ccp->cmd_q_count; i++)
>@@ -1046,6 +1048,8 @@ static void ccp5_destroy(struct ccp_device *ccp)
> 			kthread_stop(ccp->cmd_q[i].kthread);
> 
> 	sp_free_ccp_irq(ccp->sp, ccp);
>+	if (ccp->use_tasklet)
>+		tasklet_kill(&ccp->irq_tasklet);
> 
> 	/* Flush the cmd and backlog queue */
> 	while (!list_empty(&ccp->cmd)) {
>-- 
>2.34.1