[PATCH] crypto: cesa: complete pending requests on device remove

[Rosen Penev <rosenp@gmail.com>]

mv_cesa_remove() unregisters the algorithms and frees the IRQs but never
drains the engine queues. Each engine can still hold outstanding requests
in three places: engine->req (currently in flight), engine->queue (queued
but not started), and engine->complete_queue (processed but not yet
reported). The latter two are only completed from the IRQ handler, which
is torn down before they are flushed.

If the device is unbound via sysfs while requests are outstanding, those
waiters never receive their completion callback and block indefinitely,
leaking the request and its scatterlist buffers.

Drain all three queues in mv_cesa_remove() and complete each remaining
request with -ENOENT before freeing the IRQ, so bound tasks are released.

Assisted-by: LLM
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 drivers/crypto/marvell/cesa/cesa.c | 46 ++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/drivers/crypto/marvell/cesa/cesa.c b/drivers/crypto/marvell/cesa/cesa.c
index 564b09773507..25a30deca4c5 100644
--- a/drivers/crypto/marvell/cesa/cesa.c
+++ b/drivers/crypto/marvell/cesa/cesa.c
@@ -546,6 +546,52 @@ static void mv_cesa_remove(struct platform_device *pdev)
 	mv_cesa_remove_algs(cesa);
 
 	cesa_dev = NULL;
+
+	for (int i = 0; i < cesa->caps->nengines; i++) {
+		struct mv_cesa_engine *engine = &cesa->engines[i];
+		struct crypto_async_request *req;
+
+		/*
+		 * Stop the engine before releasing resources so it no longer
+		 * issues DMA to the SRAM region or to request scatterlists
+		 * that are about to be unmapped.
+		 */
+		writel(0, engine->regs + CESA_SA_INT_MSK);
+		writel(0, engine->regs + CESA_SA_CMD);
+		writel(0, engine->regs + CESA_TDMA_CONTROL);
+
+		spin_lock_bh(&engine->lock);
+		/*
+		 * Complete the request currently in flight and drain the
+		 * pending and already-processed queues with an error so that
+		 * waiters do not block indefinitely when the device is unbound
+		 * while requests are still outstanding.
+		 */
+		if (engine->req) {
+			req = engine->req;
+			engine->req = NULL;
+			spin_unlock_bh(&engine->lock);
+			mv_cesa_complete_req(crypto_tfm_ctx(req->tfm), req,
+					     -ENOENT);
+			spin_lock_bh(&engine->lock);
+		}
+
+		while ((req = crypto_dequeue_request(&engine->queue)) != NULL) {
+			spin_unlock_bh(&engine->lock);
+			mv_cesa_complete_req(crypto_tfm_ctx(req->tfm), req,
+					     -ENOENT);
+			spin_lock_bh(&engine->lock);
+		}
+
+		while ((req = mv_cesa_engine_dequeue_complete_request(engine))
+		       != NULL) {
+			spin_unlock_bh(&engine->lock);
+			mv_cesa_complete_req(crypto_tfm_ctx(req->tfm), req,
+					     -ENOENT);
+			spin_lock_bh(&engine->lock);
+		}
+		spin_unlock_bh(&engine->lock);
+	}
 }
 
 static const struct platform_device_id mv_cesa_plat_id_table[] = {
-- 
2.55.0