Re: [PATCH] crypto: qat - avoid double free of authentication descriptor

[Herbert Xu <herbert@gondor.apana.org.au>]

On Wed, Nov 04, 2026 at 10:23:45AM +0000, Ahsan Atta wrote:
> From: Svyatoslav Pankratov <svyatoslav.pankratov@intel.com>
> 
> qat_uclo_wr_suof_img() reuses a single struct icp_qat_fw_auth_desc
> pointer across all signed images. At the end of every loop iteration
> qat_uclo_ummap_auth_fw() releases the DMA buffer backing the
> descriptor, but leaves the caller's pointer untouched.
> 
> If qat_uclo_map_auth_fw() then fails for a subsequent image before it
> assigns a new descriptor, for example when qat_uclo_simg_alloc()
> cannot allocate the DMA region, the error path jumps to wr_err and
> calls qat_uclo_ummap_auth_fw() again on the stale pointer. This reads
> chunk_bus_addr and chunk_size from already freed coherent memory and
> passes them to dma_free_coherent(), resulting in a use-after-free and
> a double free.
> 
> Clear the descriptor pointer in qat_uclo_ummap_auth_fw() after the
> buffer is released so that it is unmapped at most once.
> 
> Fixes: b0272276d903 ("crypto: qat - add support for new devices to FW loader")
> Signed-off-by: Svyatoslav Pankratov <svyatoslav.pankratov@intel.com>
> Signed-off-by: Ahsan Atta <ahsan.atta@intel.com>
> Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
> ---
>  drivers/crypto/intel/qat/qat_common/qat_uclo.c | 1 +
>  1 file changed, 1 insertion(+)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt