Commit 6624bba469a3 for kernel

commit 6624bba469a325ecd699feae400b77cd11c76b98
Author: Jinliang Zheng <alexjlzheng@tencent.com>
Date:   Mon May 11 23:30:59 2026 +0800

    macsec: use rcu_work to defer RX SA crypto cleanup out of softirq

    crypto_free_aead() can internally invoke vunmap() (e.g. via
    dma_free_attrs() in hardware crypto drivers such as hisi_sec2).
    vunmap() must not be called from softirq context, but free_rxsa()
    is an RCU callback that runs in softirq, leading to a kernel crash:

      vunmap+0x4c/0x70
      __iommu_dma_free+0xd0/0x138
      dma_free_attrs+0xf4/0x100
      sec_aead_exit+0x64/0xb8 [hisi_sec2]
      crypto_destroy_tfm+0x98/0x110
      free_rxsa+0x28/0x50 [macsec]
      rcu_do_batch+0x184/0x460
      rcu_core+0xf4/0x1f8
      handle_softirqs+0x118/0x330

    Use rcu_work to defer the cleanup to a workqueue. rcu_work dispatches
    the worker asynchronously after the RCU grace period, so no thread
    blocks waiting, and concurrent releases of multiple SAs naturally
    share the same grace period.

    Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver")
    Signed-off-by: Jinliang Zheng <alexjlzheng@tencent.com>
    Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
    Link: https://patch.msgid.link/20260511153102.2640368-3-alexjlzheng@tencent.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index ef5ac634f916..e7ad24f1ea5b 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -176,9 +176,10 @@ static void macsec_rxsc_put(struct macsec_rx_sc *sc)
 		call_rcu(&sc->rcu_head, free_rx_sc_rcu);
 }

-static void free_rxsa(struct rcu_head *head)
+static void free_rxsa_work(struct work_struct *work)
 {
-	struct macsec_rx_sa *sa = container_of(head, struct macsec_rx_sa, rcu);
+	struct macsec_rx_sa *sa =
+		container_of(to_rcu_work(work), struct macsec_rx_sa, destroy_work);

 	crypto_free_aead(sa->key.tfm);
 	free_percpu(sa->stats);
@@ -188,7 +189,7 @@ static void free_rxsa(struct rcu_head *head)
 static void macsec_rxsa_put(struct macsec_rx_sa *sa)
 {
 	if (refcount_dec_and_test(&sa->refcnt))
-		call_rcu(&sa->rcu, free_rxsa);
+		queue_rcu_work(macsec_wq, &sa->destroy_work);
 }

 static struct macsec_tx_sa *macsec_txsa_get(struct macsec_tx_sa __rcu *ptr)
@@ -1409,6 +1410,7 @@ static int init_rx_sa(struct macsec_rx_sa *rx_sa, char *sak, int key_len,
 	rx_sa->next_pn = 1;
 	refcount_set(&rx_sa->refcnt, 1);
 	spin_lock_init(&rx_sa->lock);
+	INIT_RCU_WORK(&rx_sa->destroy_work, free_rxsa_work);

 	return 0;
 }
diff --git a/include/net/macsec.h b/include/net/macsec.h
index bc7de5b53e54..0980ef36fbf0 100644
--- a/include/net/macsec.h
+++ b/include/net/macsec.h
@@ -9,6 +9,7 @@

 #include <linux/u64_stats_sync.h>
 #include <linux/if_vlan.h>
+#include <linux/workqueue.h>
 #include <uapi/linux/if_link.h>
 #include <uapi/linux/if_macsec.h>

@@ -123,6 +124,7 @@ struct macsec_dev_stats {
  * @key: key structure
  * @ssci: short secure channel identifier
  * @stats: per-SA stats
+ * @destroy_work: deferred work to free the SA in process context after RCU grace period
  */
 struct macsec_rx_sa {
 	struct macsec_key key;
@@ -136,7 +138,7 @@ struct macsec_rx_sa {
 	bool active;
 	struct macsec_rx_sa_stats __percpu *stats;
 	struct macsec_rx_sc *sc;
-	struct rcu_head rcu;
+	struct rcu_work destroy_work;
 };

 struct pcpu_rx_sc_stats {