Skip to content

Commit

Permalink
crypto/octeontx: fix freeing after device release
Browse files Browse the repository at this point in the history
When the PMD is removed, rte_cryptodev_pmd_release_device
is called which frees cryptodev->data, and then tries to free
cryptodev->data->dev_private, which causes the heap use
after free issue.

A temporary pointer is set before the free of cryptodev->data,
which can then be used afterwards to free dev_private.

Fixes: bfe2ae4 ("crypto/octeontx: add PMD skeleton")
Cc: stable@dpdk.org

Reported-by: Zhihong Peng <zhihongx.peng@intel.com>
Signed-off-by: Akhil Goyal <gakhil@marvell.com>
  • Loading branch information
Akhil Goyal committed Jul 30, 2021
1 parent eeaeca8 commit 12b650e
Showing 1 changed file with 4 additions and 1 deletion.
5 changes: 4 additions & 1 deletion drivers/crypto/octeontx/otx_cryptodev.c
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,7 @@ otx_cpt_pci_remove(struct rte_pci_device *pci_dev)
{
struct rte_cryptodev *cryptodev;
char name[RTE_CRYPTODEV_NAME_MAX_LEN];
void *dev_priv;

if (pci_dev == NULL)
return -EINVAL;
Expand All @@ -88,11 +89,13 @@ otx_cpt_pci_remove(struct rte_pci_device *pci_dev)
if (pci_dev->driver == NULL)
return -ENODEV;

dev_priv = cryptodev->data->dev_private;

/* free crypto device */
rte_cryptodev_pmd_release_device(cryptodev);

if (rte_eal_process_type() == RTE_PROC_PRIMARY)
rte_free(cryptodev->data->dev_private);
rte_free(dev_priv);

cryptodev->device->driver = NULL;
cryptodev->device = NULL;
Expand Down

0 comments on commit 12b650e

Please sign in to comment.