From 67aefeccc4101a93627f36abbd049f191b54f903 Mon Sep 17 00:00:00 2001 From: Jiale Yao Date: Mon, 21 Sep 2026 01:34:17 +0800 Subject: [PATCH] crypto: ccp - kill v5 IRQ tasklet during teardown On PCI devices using MSI-X, ccp5_irq_handler() schedules irq_tasklet. The teardown paths release the IRQ but do not drain a tasklet that was already queued, so it can access ccp after the device-managed allocation has been released. Kill the tasklet after releasing the IRQ in both the initialization error path and ccp5_destroy(). Fixes: 6263b51eb319 ("crypto: ccp - Change ISR handler method for a v5 CCP") Signed-off-by: Jiale Yao Signed-off-by: Herbert Xu --- drivers/crypto/ccp/ccp-dev-v5.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/crypto/ccp/ccp-dev-v5.c b/drivers/crypto/ccp/ccp-dev-v5.c index dcd6aab51e47..dacde9614e8a 100644 --- a/drivers/crypto/ccp/ccp-dev-v5.c +++ b/drivers/crypto/ccp/ccp-dev-v5.c @@ -995,6 +995,8 @@ static int ccp5_init(struct ccp_device *ccp) e_irq: sp_free_ccp_irq(ccp->sp, ccp); + if (ccp->use_tasklet) + tasklet_kill(&ccp->irq_tasklet); e_pool: for (i = 0; i < ccp->cmd_q_count; i++) @@ -1046,6 +1048,8 @@ static void ccp5_destroy(struct ccp_device *ccp) kthread_stop(ccp->cmd_q[i].kthread); sp_free_ccp_irq(ccp->sp, ccp); + if (ccp->use_tasklet) + tasklet_kill(&ccp->irq_tasklet); /* Flush the cmd and backlog queue */ while (!list_empty(&ccp->cmd)) {