mirror of
https://github.com/torvalds/linux.git
synced 2026-09-24 06:24:02 +02:00
aacf3a6c47
The driver uses devm_request_irq() for the IRQ, but cleans up the tasklet and DMA rings inside the remove function. Since devres frees the IRQ only after the remove function returns, a window exists where a pending hardware interrupt can reschedule the tasklet after it has been killed, leading to use-after-free of the descriptor rings. Fix by switching to plain request_irq() and adding the corresponding free_irq() calls in the remove function and the probe error path before tasklet_kill(), ensuring the IRQ is fully torn down before the tasklet is killed. Rename goto error path to err_tasklet as that's more descriptive. Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> |
||
|---|---|---|
| .. | ||
| crypto4xx_alg.c | ||
| crypto4xx_core.c | ||
| crypto4xx_core.h | ||
| crypto4xx_reg_def.h | ||
| crypto4xx_sa.h | ||
| crypto4xx_trng.c | ||
| crypto4xx_trng.h | ||
| Makefile | ||