ed6b38f5b4
commit d3b17c6d9dddc2db3670bc9be628b122416a3d26 upstream.
Using completion_done to determine whether the caller has gone
away only works after a complete call. Furthermore it's still
possible that the caller has not yet called wait_for_completion,
resulting in another potential UAF.
Fix this by making the caller use cancel_work_sync and then freeing
the memory safely.
Fixes: 7d42e097607c ("crypto: qat - resolve race condition during AER recovery")
Cc: <stable@vger.kernel.org> #6.8+
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|---|---|---|
| .. | ||
| adf_accel_devices.h | ||
| adf_accel_engine.c | ||
| adf_admin.c | ||
| adf_aer.c | ||
| adf_cfg.c | ||
| adf_cfg.h | ||
| adf_cfg_common.h | ||
| adf_cfg_strings.h | ||
| adf_cfg_user.h | ||
| adf_common_drv.h | ||
| adf_ctl_drv.c | ||
| adf_dev_mgr.c | ||
| adf_hw_arbiter.c | ||
| adf_init.c | ||
| adf_isr.c | ||
| adf_pf2vf_msg.c | ||
| adf_pf2vf_msg.h | ||
| adf_sriov.c | ||
| adf_transport.c | ||
| adf_transport.h | ||
| adf_transport_access_macros.h | ||
| adf_transport_debug.c | ||
| adf_transport_internal.h | ||
| adf_vf2pf_msg.c | ||
| adf_vf_isr.c | ||
| icp_qat_fw.h | ||
| icp_qat_fw_init_admin.h | ||
| icp_qat_fw_la.h | ||
| icp_qat_fw_loader_handle.h | ||
| icp_qat_fw_pke.h | ||
| icp_qat_hal.h | ||
| icp_qat_hw.h | ||
| icp_qat_uclo.h | ||
| Makefile | ||
| qat_algs.c | ||
| qat_asym_algs.c | ||
| qat_crypto.c | ||
| qat_crypto.h | ||
| qat_hal.c | ||
| qat_uclo.c | ||