Unverified Commit c95e1051 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!6968 CVE-2024-26974 

Merge Pull Request from: @ci-robot 
 
PR sync from: Xia Fukun <xiafukun@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/LH432G3DTUSRFYO5M5GW5XS6I367GMF7/ 
CVE-2024-26974 patch:

Damian Muszynski (1):
  crypto: qat - resolve race condition during AER recovery

Svyatoslav Pankratov (1):
  crypto: qat - fix double free during reset


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/I9L5LW 
 
Link:https://gitee.com/openeuler/kernel/pulls/6968

 

Reviewed-by: default avatarZucheng Zheng <zhengzucheng@huawei.com>
Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 7a859b3f e7836e1b

drivers/crypto/qat/qat_common/adf_aer.c

+17 −6
Original line number Diff line number Diff line
@@ -139,6 +139,8 @@ static void adf_device_reset_worker(struct work_struct *work) 
	if (adf_dev_init(accel_dev) || adf_dev_start(accel_dev)) {

		/* The device hanged and we can't restart it so stop here */

		dev_err(&GET_DEV(accel_dev), "Restart device failed\n");

		if (reset_data->mode == ADF_DEV_RESET_ASYNC ||

		    completion_done(&reset_data->compl))

			kfree(reset_data);

		WARN(1, "QAT: device restart failed. Device is unusable\n");

		return;
@@ -146,11 +148,19 @@ static void adf_device_reset_worker(struct work_struct *work) 
	adf_dev_restarted_notify(accel_dev);

	clear_bit(ADF_STATUS_RESTARTING, &accel_dev->status);



	/* The dev is back alive. Notify the caller if in sync mode */

	if (reset_data->mode == ADF_DEV_RESET_SYNC)

		complete(&reset_data->compl);

	else

	/*

	 * The dev is back alive. Notify the caller if in sync mode

	 *

	 * If device restart will take a more time than expected,

	 * the schedule_reset() function can timeout and exit. This can be

	 * detected by calling the completion_done() function. In this case

	 * the reset_data structure needs to be freed here.

	 */

	if (reset_data->mode == ADF_DEV_RESET_ASYNC ||

	    completion_done(&reset_data->compl))

		kfree(reset_data);

	else

		complete(&reset_data->compl);

}



static int adf_dev_aer_schedule_reset(struct adf_accel_dev *accel_dev,
@@ -183,8 +193,9 @@ static int adf_dev_aer_schedule_reset(struct adf_accel_dev *accel_dev, 
			dev_err(&GET_DEV(accel_dev),

				"Reset device timeout expired\n");

			ret = -EFAULT;

		}

		} else {

			kfree(reset_data);

		}

		return ret;

	}

	return 0;