crypto: amcc - fix racy teardown with devm_request_irq

The driver uses devm_request_irq() for the IRQ, but cleans up the
tasklet and DMA rings inside the remove function.  Since devres frees
the IRQ only after the remove function returns, a window exists where a
pending hardware interrupt can reschedule the tasklet after it has been
killed, leading to use-after-free of the descriptor rings.

Fix by switching to plain request_irq() and adding the corresponding
free_irq() calls in the remove function and the probe error path before
tasklet_kill(), ensuring the IRQ is fully torn down before the tasklet
is killed.

Rename goto error path to err_tasklet as that's more descriptive.

Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

0 files changed, 0 insertions, 0 deletions