ASPEED crypto/ACRY accelerator driver (drivers/crypto/aspeed): The ACRY driver's probe error path and its remove path

Impact

The ACRY driver's probe error path and its remove path both hand-free a clock that the device-managed allocator will free again, giving a double free in the BMC kernel. It sits in the crypto accelerator the BMC uses for TLS and firmware signature work, which is the wrong place to have allocator corruption: a double free in a driver that touches signing and TLS paths is the kind of primitive that turns into controlled kernel memory reuse rather than just a crash. Realistic near-term impact is BMC kernel instability during driver load failures or module removal.

Who can reach it

BMC-local. Reached through driver probe failure or an explicit driver removal, so it needs root on the BMC or a boot-time condition that makes probe fail. Not host- or network-reachable directly.

What to do

Kernel fix, backported into 6.6.117, 6.12.58 and 6.17.8 and later. In practice: BMC firmware flash per node, out-of-band, whenever your ODM rebases - which for a fix this recent will realistically be a full release cycle away. No config mitigation; the crypto driver is loaded because bmcweb's TLS wants it. Track it, do not run a special campaign for it.

References