crypto/octeontx: fix freeing after device release

[ upstream commit 12b650e ]

When the PMD is removed, rte_cryptodev_pmd_release_device
is called which frees cryptodev->data, and then tries to free
cryptodev->data->dev_private, which causes the heap use
after free issue.

A temporary pointer is set before the free of cryptodev->data,
which can then be used afterwards to free dev_private.

Fixes: bfe2ae4 ("crypto/octeontx: add PMD skeleton")

Reported-by: Zhihong Peng <zhihongx.peng@intel.com>
Signed-off-by: Akhil Goyal <gakhil@marvell.com>

drivers/crypto/octeontx/otx_cryptodev.c

@@ -71,6 +71,7 @@ otx_cpt_pci_remove(struct rte_pci_device *pci_dev)
 {
 	struct rte_cryptodev *cryptodev;
 	char name[RTE_CRYPTODEV_NAME_MAX_LEN];
+	void *dev_priv;
 
 	if (pci_dev == NULL)
 		return -EINVAL;
@@ -84,11 +85,13 @@ otx_cpt_pci_remove(struct rte_pci_device *pci_dev)
 	if (pci_dev->driver == NULL)
 		return -ENODEV;
 
+	dev_priv = cryptodev->data->dev_private;
+
 	/* free crypto device */
 	rte_cryptodev_pmd_release_device(cryptodev);
 
 	if (rte_eal_process_type() == RTE_PROC_PRIMARY)
-		rte_free(cryptodev->data->dev_private);
+		rte_free(dev_priv);
 
 	cryptodev->device->driver = NULL;
 	cryptodev->device = NULL;