CVE-2026-64599: crypto: amlogic - avoid double cleanup in meson_crypto_probe()

In the Linux kernel, the following vulnerability has been resolved:

crypto: amlogic - avoid double cleanup in mesoncryptoprobe()

When mesonallocatechanlist() fails after a partial allocation, it already unwinds the allocated chanlist state through its local error path. mesoncryptoprobe() then jump to errorflow and calls mesonfreechanlist() again, causing the same per-flow resources to be torn down twice. In the reproduced failure path, the second teardown re-entered cryptoengineexit() on an already destroyed worker and KASAN reported a slab-use-after-free in kthreaddestroyworker().

Prevent double-free by handling partial allocation failures locally within mesonallocatechanlist() and skipping the outer cleanup path.

The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available.

The bug was reproduced in a QEMU x8664 guest booted with KASAN on v7.1, using the reproducer under tools/testing/mesoncryptoprobe. The reproducer forces the second dmaallocattrs() call in the gxl-crypto probe path to return NULL, making mesonallocatechanlist() fail after partial initialization. On the unpatched kernel this reliably triggered a slab-use-after-free. With this fix applied, the same reproducer no longer emits any KASAN report and the probe fails cleanly with -ENOMEM.

================================================================== BUG: KASAN: slab-use-after-free in kthreaddestroyworker+0xb2/0xd0 Read of size 8 at addr ff1100010c057a68 by task insmod/265

CPU: 1 UID: 0 PID: 265 Comm: insmod Tainted: G O 7.1.0-rc2-00376-g810af9adc907-dirty #10 PREEMPT(lazy) Tainted: [O]=OOTMODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> dumpstacklvl+0x68/0xa0 printreport+0xcb/0x5e0 ? virtaddrvalid+0x21d/0x3f0 ? kthreaddestroyworker+0xb2/0xd0 ? kthreaddestroyworker+0xb2/0xd0 kasanreport+0xca/0x100 ? kthreaddestroyworker+0xb2/0xd0 kthreaddestroyworker+0xb2/0xd0 mesoncryptoprobe+0x4d0/0xc10 [amlogicgxlcrypto] platformprobe+0x99/0x140 reallyprobe+0x1c6/0x6a0 ? pfxdeviceattachdriver+0x10/0x10 driverprobedevice+0x248/0x310 ? acpidrivermatchdevice+0xb0/0x100 driverprobedevice+0x48/0x210 ? pfxdeviceattachdriver+0x10/0x10 deviceattachdriver+0x160/0x320 busforeachdrv+0x104/0x190 ? pfxbusforeachdrv+0x10/0x10 ? rawspinunlockirqrestore+0x2c/0x50 deviceattach+0x19d/0x3b0 ? pfxdeviceattach+0x10/0x10 ? dorawspinunlock+0x53/0x220 deviceinitialprobe+0x78/0xa0 busprobedevice+0x5b/0x130 deviceadd+0xcfd/0x1430 ? pfxdeviceadd+0x10/0x10 ? insertresource+0x34/0x50 ? lockrelease+0xc9/0x290 platformdeviceadd+0x24e/0x590 ? pfxmesoncryptoprobereproinit+0x10/0x10 [mesoncryptoproberepro] mesoncryptoprobereproinit+0x330/0xff0 [mesoncryptoproberepro] dooneinitcall+0xc0/0x450 ? pfxdooneinitcall+0x10/0x10 ? rawspinunlockirqrestore+0x2c/0x50 ? createobject+0x59/0x80 ? kasanunpoison+0x27/0x60 doinitmodule+0x27b/0x7d0 ? pfxdoinitmodule+0x10/0x10 ? kasanquarantineput+0x84/0x1d0 ? kfree+0x32c/0x510 ? loadmodule+0x561e/0x5ff0 loadmodule+0x54fe/0x5ff0 ? pfxloadmodule+0x10/0x10 ? securityfilepermission+0x20/0x40 ? kernelreadfile+0x23d/0x6e0 ? mmapregion+0x235/0x4a0 ? pfxkernelreadfile+0x10/0x10 ? filehasperm+0x2c0/0x3e0 initmodulefromfile+0x158/0x180 ? pfxinitmodulefromfile+0x10/0x10 ? lockacquire+0x45a/0x1ba0 ? idempotentinitmodule+0x315/0x610 ? lockrelease+0xc9/0x290 ? lock ---truncated---