[PATCH] crypto: qat - avoid double free of authentication descriptor

[Ahsan Atta <ahsan.atta@intel.com>]

From: Svyatoslav Pankratov <svyatoslav.pankratov@intel.com>

qat_uclo_wr_suof_img() reuses a single struct icp_qat_fw_auth_desc
pointer across all signed images. At the end of every loop iteration
qat_uclo_ummap_auth_fw() releases the DMA buffer backing the
descriptor, but leaves the caller's pointer untouched.

If qat_uclo_map_auth_fw() then fails for a subsequent image before it
assigns a new descriptor, for example when qat_uclo_simg_alloc()
cannot allocate the DMA region, the error path jumps to wr_err and
calls qat_uclo_ummap_auth_fw() again on the stale pointer. This reads
chunk_bus_addr and chunk_size from already freed coherent memory and
passes them to dma_free_coherent(), resulting in a use-after-free and
a double free.

Clear the descriptor pointer in qat_uclo_ummap_auth_fw() after the
buffer is released so that it is unmapped at most once.

Fixes: b0272276d903 ("crypto: qat - add support for new devices to FW loader")
Signed-off-by: Svyatoslav Pankratov <svyatoslav.pankratov@intel.com>
Signed-off-by: Ahsan Atta <ahsan.atta@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
---
 drivers/crypto/intel/qat/qat_common/qat_uclo.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/crypto/intel/qat/qat_common/qat_uclo.c b/drivers/crypto/intel/qat/qat_common/qat_uclo.c
index a00ca2a0900f..e0ff6b232e91 100644
--- a/drivers/crypto/intel/qat/qat_common/qat_uclo.c
+++ b/drivers/crypto/intel/qat/qat_common/qat_uclo.c
@@ -1398,6 +1398,7 @@ static void qat_uclo_ummap_auth_fw(struct icp_qat_fw_loader_handle *handle,
 		dram_desc.dram_size = ((struct icp_qat_auth_chunk *)
 				       (*desc))->chunk_size;
 		qat_uclo_simg_free(handle, &dram_desc);
+		*desc = NULL;
 	}
 }
 
-- 
2.50.1