[PATCH] crypto: amlogic - Free channel IRQs before disabling the clock

[Myeonghun Pak <mhun512@gmail.com>]

The channel IRQs are requested before the managed channel array is
allocated. Automatic cleanup consequently frees that array before
releasing the IRQs. An interrupt handler that has already read a channel
completion status can still write chanlist[flow].status and complete the
channel completion after the array is released. A cipher timeout allows
such a late handler even after its crypto engine becomes idle.

Release the IRQs explicitly before disabling the bus clock and before
devres can release the channel array. Do this after crypto_engine_exit()
so normal requests retain their interrupt-driven completion while the
engines drain. Use the same cleanup on probe failures after the clock
has been enabled, preserving the channel allocator's existing unwind.

This issue was identified as part of our ongoing research while
reviewing kernel code.

Fixes: 48fe583fe541 ("crypto: amlogic - Add crypto accelerator for amlogic GXL")
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
Compile-tested with GCC, W=1 (arm). No runtime testing.

This bounds IRQ access to completion state and registers; hardware DMA
handling after a cipher timeout is unchanged.

 drivers/crypto/amlogic/amlogic-gxl-core.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/crypto/amlogic/amlogic-gxl-core.c b/drivers/crypto/amlogic/amlogic-gxl-core.c
index 169c6ee..333db2e 100644
--- a/drivers/crypto/amlogic/amlogic-gxl-core.c
+++ b/drivers/crypto/amlogic/amlogic-gxl-core.c
@@ -136,6 +136,14 @@ static int meson_debugfs_show(struct seq_file *seq, void *v)
 }
 DEFINE_SHOW_ATTRIBUTE(meson_debugfs);
 
+static void meson_free_irqs(struct meson_dev *mc)
+{
+	int i;
+
+	for (i = 0; i < MAXFLOW; i++)
+		devm_free_irq(mc->dev, mc->irqs[i], mc);
+}
+
 static void meson_free_chanlist(struct meson_dev *mc, int i)
 {
 	while (i >= 0) {
@@ -291,6 +299,7 @@ static int meson_crypto_probe(struct platform_device *pdev)
 	meson_unregister_algs(mc);
 	meson_free_chanlist(mc, MAXFLOW - 1);
 error_flow:
+	meson_free_irqs(mc);
 	clk_disable_unprepare(mc->busclk);
 	return err;
 }
@@ -306,6 +315,7 @@ static void meson_crypto_remove(struct platform_device *pdev)
 	meson_unregister_algs(mc);
 
 	meson_free_chanlist(mc, MAXFLOW - 1);
+	meson_free_irqs(mc);
 
 	clk_disable_unprepare(mc->busclk);
 }