From 151569886c10a82650a59813a1f595fcfd25abef Mon Sep 17 00:00:00 2001 From: Ciara Power Date: Wed, 21 Jul 2021 12:51:22 +0000 Subject: [PATCH] cryptodev: fix freeing after device release [ upstream commit eeaeca82b8cbd6599bafd4029aad5ce4dedff7a2 ] The PMD destroy function was calling the release function, which frees cryptodev->data, and then tries to free cryptodev->data->dev_private, which causes the heap use after free issue. A temporary pointer is set before the free of cryptodev->data, which can then be used afterwards to free dev_private. The free cannot be moved to before the release function is called, as dev_private is used in the PMD close function while being released. Fixes: 9e6edea41805 ("cryptodev: add APIs to assist PMD initialisation") Reported-by: Zhihong Peng Signed-off-by: Ciara Power Acked-by: Akhil Goyal --- lib/librte_cryptodev/rte_cryptodev_pmd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/librte_cryptodev/rte_cryptodev_pmd.c b/lib/librte_cryptodev/rte_cryptodev_pmd.c index 0912004127..e342daabc4 100644 --- a/lib/librte_cryptodev/rte_cryptodev_pmd.c +++ b/lib/librte_cryptodev/rte_cryptodev_pmd.c @@ -140,6 +140,7 @@ int rte_cryptodev_pmd_destroy(struct rte_cryptodev *cryptodev) { int retval; + void *dev_priv = cryptodev->data->dev_private; CDEV_LOG_INFO("Closing crypto device %s", cryptodev->device->name); @@ -149,7 +150,7 @@ rte_cryptodev_pmd_destroy(struct rte_cryptodev *cryptodev) return retval; if (rte_eal_process_type() == RTE_PROC_PRIMARY) - rte_free(cryptodev->data->dev_private); + rte_free(dev_priv); cryptodev->device = NULL;