c13fddbcff
JIRA: https://issues.redhat.com/browse/RHEL-35816 Upstream Status: merged into the linux.git CVE: CVE-2024-26974 commit d3b17c6d9dddc2db3670bc9be628b122416a3d26 Author: Herbert Xu <herbert@gondor.apana.org.au> Date: Wed May 8 16:39:51 2024 +0800 crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak Using completion_done to determine whether the caller has gone away only works after a complete call. Furthermore it's still possible that the caller has not yet called wait_for_completion, resulting in another potential UAF. Fix this by making the caller use cancel_work_sync and then freeing the memory safely. Fixes: 7d42e097607c ("crypto: qat - resolve race condition during AER recovery") Cc: <stable@vger.kernel.org> #6.8+ Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Vladis Dronov <vdronov@redhat.com> |
||
|---|---|---|
| .. | ||
| iaa | ||
| ixp4xx | ||
| keembay | ||
| qat | ||
| Kconfig | ||
| Makefile | ||