DPDK patches and discussions
 help / color / mirror / Atom feed
* [dpdk-dev] [PATCH] crypto/octeontx: fix heap use after free
@ 2021-07-30 18:17 Akhil Goyal
  2021-07-30 19:25 ` Akhil Goyal
  0 siblings, 1 reply; 2+ messages in thread
From: Akhil Goyal @ 2021-07-30 18:17 UTC (permalink / raw)
  To: dev; +Cc: anoobj, ciara.power, zhihongx.peng, Akhil Goyal, stable

When the PMD is removed, rte_cryptodev_pmd_release_device
is called which frees cryptodev->data, and then tries to free
cryptodev->data->dev_private, which causes the heap use
after free issue.

A temporary pointer is set before the free of cryptodev->data,
which can then be used afterwards to free dev_private.

Fixes: bfe2ae495ee2 ("crypto/octeontx: add PMD skeleton")
Cc: stable@dpdk.org

Reported-by: ZhihongX Peng <zhihongx.peng@intel.com>
Signed-off-by: Akhil Goyal <gakhil@marvell.com>
---
 drivers/crypto/octeontx/otx_cryptodev.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/octeontx/otx_cryptodev.c b/drivers/crypto/octeontx/otx_cryptodev.c
index 7207909abb..3822c0d779 100644
--- a/drivers/crypto/octeontx/otx_cryptodev.c
+++ b/drivers/crypto/octeontx/otx_cryptodev.c
@@ -75,6 +75,7 @@ otx_cpt_pci_remove(struct rte_pci_device *pci_dev)
 {
 	struct rte_cryptodev *cryptodev;
 	char name[RTE_CRYPTODEV_NAME_MAX_LEN];
+	void *dev_priv;
 
 	if (pci_dev == NULL)
 		return -EINVAL;
@@ -88,11 +89,13 @@ otx_cpt_pci_remove(struct rte_pci_device *pci_dev)
 	if (pci_dev->driver == NULL)
 		return -ENODEV;
 
+	dev_priv = cryptodev->data->dev_private;
+
 	/* free crypto device */
 	rte_cryptodev_pmd_release_device(cryptodev);
 
 	if (rte_eal_process_type() == RTE_PROC_PRIMARY)
-		rte_free(cryptodev->data->dev_private);
+		rte_free(dev_priv);
 
 	cryptodev->device->driver = NULL;
 	cryptodev->device = NULL;
-- 
2.25.1


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [dpdk-dev] [PATCH] crypto/octeontx: fix heap use after free
  2021-07-30 18:17 [dpdk-dev] [PATCH] crypto/octeontx: fix heap use after free Akhil Goyal
@ 2021-07-30 19:25 ` Akhil Goyal
  0 siblings, 0 replies; 2+ messages in thread
From: Akhil Goyal @ 2021-07-30 19:25 UTC (permalink / raw)
  To: dev; +Cc: Anoob Joseph, ciara.power, zhihongx.peng, stable

> Subject: [PATCH] crypto/octeontx: fix heap use after free
> 
> When the PMD is removed, rte_cryptodev_pmd_release_device
> is called which frees cryptodev->data, and then tries to free
> cryptodev->data->dev_private, which causes the heap use
> after free issue.
> 
> A temporary pointer is set before the free of cryptodev->data,
> which can then be used afterwards to free dev_private.
> 
> Fixes: bfe2ae495ee2 ("crypto/octeontx: add PMD skeleton")
> Cc: stable@dpdk.org
> 
> Reported-by: ZhihongX Peng <zhihongx.peng@intel.com>
> Signed-off-by: Akhil Goyal <gakhil@marvell.com>

Applied to dpdk-next-crypto


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2021-07-30 19:25 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-30 18:17 [dpdk-dev] [PATCH] crypto/octeontx: fix heap use after free Akhil Goyal
2021-07-30 19:25 ` Akhil Goyal

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).