Commit 94aca86f authored by Svyatoslav Pankratov's avatar Svyatoslav Pankratov Committed by Xia Fukun
Browse files

crypto: qat - fix double free during reset 

stable inclusion
from stable-v4.19.313
commit 277035d2da928bb50ff5ba8723dc4f0284284223
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5LW
CVE: CVE-2024-26974

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.19.y&id=277035d2da928bb50ff5ba8723dc4f0284284223



--------------------------------

[ Upstream commit 01aed663e6c421aeafc9c330bda630976b50a764 ]

There is no need to free the reset_data structure if the recovery is
unsuccessful and the reset is synchronous. The function
adf_dev_aer_schedule_reset() handles the cleanup properly. Only
asynchronous resets require such structure to be freed inside the reset
worker.

Fixes: d8cba25d ("crypto: qat - Intel(R) QAT driver framework")
Signed-off-by: default avatarSvyatoslav Pankratov <svyatoslav.pankratov@intel.com>
Signed-off-by: default avatarGiovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Stable-dep-of: 7d42e097607c ("crypto: qat - resolve race condition during AER recovery")
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarXia Fukun <xiafukun@huawei.com>
parent b9f13a64

drivers/crypto/qat/qat_common/adf_aer.c

+2 −1
Original line number Diff line number Diff line
@@ -139,6 +139,7 @@ static void adf_device_reset_worker(struct work_struct *work) 
	if (adf_dev_init(accel_dev) || adf_dev_start(accel_dev)) {

		/* The device hanged and we can't restart it so stop here */

		dev_err(&GET_DEV(accel_dev), "Restart device failed\n");

		if (reset_data->mode == ADF_DEV_RESET_ASYNC)

			kfree(reset_data);

		WARN(1, "QAT: device restart failed. Device is unusable\n");

		return;