omap_aes_remove() unconditionally dereferences dd->pdata->aead_algs_info, but only omap_aes_pdata_omap4 initializes that field: static const struct omap_aes_pdata omap_aes_pdata_omap2 = { .algs_info = omap_aes_algs_info_ecb_cbc, ... }; static const struct omap_aes_pdata omap_aes_pdata_omap3 = { .algs_info = omap_aes_algs_info_ecb_cbc_ctr, ... }; static const struct omap_aes_pdata omap_aes_pdata_omap4 = { ... .aead_algs_info = &omap_aes_aead_info, ... }; For omap2 and omap3 the field stays NULL, so on those SoCs unbinding the bound device (e.g. via sysfs unbind) or unloading the module (rmmod) dereferences a NULL pointer: crypto_engine_unregister_aeads(dd->pdata->aead_algs_info->algs_list, dd->pdata->aead_algs_info->registered); dd->pdata->aead_algs_info->registered = 0; This is a hard crash, reachable from the teardown path only; probe errors do not get here. The asymmetry dates back to the commit that introduced GCM support, which guarded the registration of the AEAD algorithms but not their unregistration. The registration path in omap_aes_probe() already guards the same access with "if (dd->pdata->aead_algs_info && ...)", so add the matching check to the remove path. Fixes: ad18cc9d0f91 ("crypto: omap-aes - Add support for GCM mode") Cc: stable@vger.kernel.org Signed-off-by: ZhaoJinming --- drivers/crypto/omap-aes.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/crypto/omap-aes.c b/drivers/crypto/omap-aes.c index d40074e5a142..8a932451ccf9 100644 --- a/drivers/crypto/omap-aes.c +++ b/drivers/crypto/omap-aes.c @@ -1199,9 +1199,11 @@ static void omap_aes_remove(struct platform_device *pdev) omap_aes_unregister_algs(dd->pdata); - crypto_engine_unregister_aeads(dd->pdata->aead_algs_info->algs_list, - dd->pdata->aead_algs_info->registered); - dd->pdata->aead_algs_info->registered = 0; + if (dd->pdata->aead_algs_info) { + crypto_engine_unregister_aeads(dd->pdata->aead_algs_info->algs_list, + dd->pdata->aead_algs_info->registered); + dd->pdata->aead_algs_info->registered = 0; + } crypto_engine_exit(dd->engine); --- base-commit: 2f2f7eeef8b0a1a9b9ca998231419873ccae8d4e change-id: 20261016-omap-aes-remove-null-deref-a3444b7bb17d Best regards, -- ZhaoJinming