[PATCH 0/2] crypto: qat - fix config table locking

[Ahsan Atta <ahsan.atta@intel.com>]

The per-device configuration table is protected by cfg->lock, but not
every access to it takes that lock. adf_cfg_sec_find() walks the section
list unlocked and returns a pointer that its callers then dereference
under cfg->lock, so the section can be freed between the lookup and the
use. The dev_cfg debugfs reader walks both the section list and each
section's key-value list under a driver-global mutex that none of the
writers take, so it does not serialise against config writes, device down
or device removal, any of which can free the entry it is walking. This
series moves these accesses under the per-device cfg->lock and then drops
the redundant list walks that are no longer needed once the section is
resolved under that lock.

Note on the debugfs lock change:
The dev_cfg reader now takes a lock that lives inside the structure freed
by adf_cfg_dev_remove(). This is safe because every cleanup path calls
adf_dbgfs_exit(), which removes the dev_cfg file, before
adf_cfg_dev_remove() frees the table, and debugfs_remove() waits for
in-flight file operations to complete.

In summary:
Patch #1: Take cfg->lock around the config section lookups and switch the
dev_cfg debugfs reader to the same per-device lock. This closes the
use-after-free windows against section deletion and key updates, makes the
lookup and insert in adf_cfg_section_add() atomic so that a section can no
longer be created twice, and removes the now unused global
qat_cfg_read_lock.

Patch #2: Look up an existing key-value entry once in
adf_cfg_add_key_value_param() and act on that pointer directly. With the
section already resolved under cfg->lock, the list walks done by
adf_cfg_key_val_get() and adf_cfg_keyval_remove() are redundant, so both
those calls and the on-stack value copy are dropped. No functional change.

Ahsan Atta (2):
  crypto: qat - hold cfg->lock when accessing config sections
  crypto: qat - avoid redundant config list walks when adding a key

 drivers/crypto/intel/qat/qat_common/adf_cfg.c | 84 +++++++++----------
 1 file changed, 38 insertions(+), 46 deletions(-)


base-commit: c72ab95b5aae0f0412dc1d3284ec446ad1b315e2
-- 
2.50.1