crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak
mainline inclusion from mainline-v6.10-rc1 commit d3b17c6d9dddc2db3670bc9be628b122416a3d26 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAC3MY CVE: CVE-2024-39493 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d3b17c6d9dddc2db3670bc9be628b122416a3d26 --------------------------- Using completion_done to determine whether the caller has gone away only works after a complete call. Furthermore it's still possible that the caller has not yet called wait_for_completion, resulting in another potential UAF. Fix this by making the caller use cancel_work_sync and then freeing the memory safely. Fixes: 7d42e097607c ("crypto: qat - resolve race condition during AER recovery") Cc: <stable@vger.kernel.org> #6.8+ Signed-off-by:Herbert Xu <herbert@gondor.apana.org.au> Reviewed-by:
Giovanni Cabiddu <giovanni.cabiddu@intel.com> Signed-off-by:
Herbert Xu <herbert@gondor.apana.org.au> Conflicts: drivers/crypto/qat/qat_common/adf_aer.c drivers/crypto/intel/qat/qat_common/adf_aer.c [Fix context diff] Signed-off-by:
Ye Bin <yebin10@huawei.com>
Loading
Please sign in to comment