A failed DOWN mailbox notification makes otx_cptvf_remove() skip all local cleanup. The driver core still completes unbind and releases the devm-allocated cptvf, leaving the raw IRQ handlers registered with that object as their argument. The sysfs group, crypto device-table entry, software queues and PCI resources also remain uncleaned. Keep the notification error diagnostic, but run local cleanup regardless of the PF response. The PF only acknowledges DOWN; it does not disable the VF queue. Disable the VQ locally and poll its INFLIGHT count for up to one second before releasing the DMA command queues. Warn if the queue does not become idle, but continue local teardown. Clear PCI bus mastering before freeing resources. Remove both IRQ handlers before killing the tasklet and releasing its resources. This issue was identified during our ongoing static-analysis research while reviewing kernel code. Fixes: 10b4f09491bf ("crypto: marvell - add the Virtual Function driver for CPT") Cc: stable@vger.kernel.org Assisted-by: LLM Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak --- Changes in v2: - Disable the local VQ and poll INFLIGHT for up to one second before freeing DMA command queues. - Warn on an idle timeout and continue local cleanup. - Clear PCI bus mastering before releasing resources. v1: https://lore.kernel.org/r/20261004042634.1130247-1-mhun512@gmail.com Review: https://sashiko.dev/#/patchset/20261004042634.1130247-1-mhun512%40gmail.com .../crypto/marvell/octeontx/otx_cptvf_main.c | 44 ++++++++++++------- 1 file changed, 29 insertions(+), 15 deletions(-) diff --git a/drivers/crypto/marvell/octeontx/otx_cptvf_main.c b/drivers/crypto/marvell/octeontx/otx_cptvf_main.c index 159c1d2..047bfc0 100644 --- a/drivers/crypto/marvell/octeontx/otx_cptvf_main.c +++ b/drivers/crypto/marvell/octeontx/otx_cptvf_main.c @@ -9,6 +9,7 @@ */ #include +#include #include #include "otx_cptvf.h" #include "otx_cptvf_algs.h" @@ -930,6 +931,8 @@ clear_drvdata: static void otx_cptvf_remove(struct pci_dev *pdev) { struct otx_cptvf *cptvf = pci_get_drvdata(pdev); + union otx_cptx_vqx_inprog vqx_inprog; + int ret; if (!cptvf) { dev_err(&pdev->dev, "Invalid CPT-VF device\n"); @@ -937,22 +940,33 @@ static void otx_cptvf_remove(struct pci_dev *pdev) } /* Convey DOWN to PF */ - if (otx_cptvf_send_vf_down(cptvf)) { + if (otx_cptvf_send_vf_down(cptvf)) dev_err(&pdev->dev, "PF not responding to DOWN msg\n"); - } else { - sysfs_remove_group(&pdev->dev.kobj, &otx_cptvf_sysfs_group); - otx_cpt_crypto_exit(pdev, THIS_MODULE, cptvf->vftype); - cptvf_free_irq_affinity(cptvf, CPT_VF_INT_VEC_E_DONE); - cptvf_free_irq_affinity(cptvf, CPT_VF_INT_VEC_E_MISC); - free_irq(pci_irq_vector(pdev, CPT_VF_INT_VEC_E_DONE), cptvf); - free_irq(pci_irq_vector(pdev, CPT_VF_INT_VEC_E_MISC), cptvf); - cptvf_sw_cleanup(cptvf); - pci_free_irq_vectors(cptvf->pdev); - pci_iounmap(pdev, cptvf->reg_base); - pci_release_regions(pdev); - pci_disable_device(pdev); - pci_set_drvdata(pdev, NULL); - } + + sysfs_remove_group(&pdev->dev.kobj, &otx_cptvf_sysfs_group); + otx_cpt_crypto_exit(pdev, THIS_MODULE, cptvf->vftype); + + /* Disable the VQ and wait for in-flight instructions to complete. */ + cptvf_write_vq_ctl(cptvf, 0); + ret = readq_poll_timeout(cptvf->reg_base + OTX_CPT_VQX_INPROG(0), + vqx_inprog.u, !vqx_inprog.s.inflight, + 10, 1000000); + if (ret) + dev_warn(&pdev->dev, "Timed out waiting for VQ to become idle\n"); + + /* Disable PCI bus mastering before releasing resources. */ + pci_clear_master(pdev); + + cptvf_free_irq_affinity(cptvf, CPT_VF_INT_VEC_E_DONE); + cptvf_free_irq_affinity(cptvf, CPT_VF_INT_VEC_E_MISC); + free_irq(pci_irq_vector(pdev, CPT_VF_INT_VEC_E_DONE), cptvf); + free_irq(pci_irq_vector(pdev, CPT_VF_INT_VEC_E_MISC), cptvf); + cptvf_sw_cleanup(cptvf); + pci_free_irq_vectors(cptvf->pdev); + pci_iounmap(pdev, cptvf->reg_base); + pci_release_regions(pdev); + pci_disable_device(pdev); + pci_set_drvdata(pdev, NULL); } /* Supported devices */ -- 2.53.0