[PATCH] crypto: qat - clear fw_loader pointer on adf_ae_init() failure

[PATCH] crypto: qat - clear fw_loader pointer on adf_ae_init() failure

[Ahsan Atta]

adf_ae_init() stores the newly allocated loader data in
accel_dev->fw_loader before calling qat_hal_init(), as the latter
publishes the HAL handle through that pointer. If either
qat_hal_init() or adf_ae_reset() fails, the error paths free the
allocation but leave accel_dev->fw_loader pointing at freed memory,
so the device is left holding a dangling pointer.

No code path dereferences that stale pointer today. This is therefore
a robustness improvement with no observable failure behind it, hence
no Fixes tag.

Clear accel_dev->fw_loader when the allocation is released, and fold
the duplicated error handling into a cascading goto chain. Report the
error returned by the callee rather than a generic -EFAULT;
adf_dev_init() still maps any failure to -EFAULT, so this is a
readability improvement and not a functional change.

Signed-off-by: Ahsan Atta <ahsan.atta@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
---
 .../intel/qat/qat_common/adf_accel_engine.c   | 21 ++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/drivers/crypto/intel/qat/qat_common/adf_accel_engine.c b/drivers/crypto/intel/qat/qat_common/adf_accel_engine.c
index bb97bbedbb8a..2db74b055201 100644
--- a/drivers/crypto/intel/qat/qat_common/adf_accel_engine.c
+++ b/drivers/crypto/intel/qat/qat_common/adf_accel_engine.c
@@ -181,6 +181,7 @@ int adf_ae_init(struct adf_accel_dev *accel_dev)
 {
 	struct adf_fw_loader_data *loader_data;
 	struct adf_hw_device_data *hw_device = accel_dev->hw_device;
+	int ret;
 
 	if (!hw_device->fw_name)
 		return 0;
@@ -190,18 +191,24 @@ int adf_ae_init(struct adf_accel_dev *accel_dev)
 		return -ENOMEM;
 
 	accel_dev->fw_loader = loader_data;
-	if (qat_hal_init(accel_dev)) {
+	ret = qat_hal_init(accel_dev);
+	if (ret) {
 		dev_err(&GET_DEV(accel_dev), "Failed to init the AEs\n");
-		kfree(loader_data);
-		return -EFAULT;
+		goto err_free_loader_data;
 	}
-	if (adf_ae_reset(accel_dev, 0)) {
+	ret = adf_ae_reset(accel_dev, 0);
+	if (ret) {
 		dev_err(&GET_DEV(accel_dev), "Failed to reset the AEs\n");
-		qat_hal_deinit(loader_data->fw_loader);
-		kfree(loader_data);
-		return -EFAULT;
+		goto err_hal_deinit;
 	}
 	return 0;
+
+err_hal_deinit:
+	qat_hal_deinit(loader_data->fw_loader);
+err_free_loader_data:
+	kfree(loader_data);
+	accel_dev->fw_loader = NULL;
+	return ret;
 }
 
 void adf_ae_shutdown(struct adf_accel_dev *accel_dev)
-- 
2.50.1

Re: [PATCH] crypto: qat - clear fw_loader pointer on adf_ae_init() failure

[Thomas Huth]

Am 03.11.26 um 11:01 schrieb Ahsan Atta:
> adf_ae_init() stores the newly allocated loader data in
> accel_dev->fw_loader before calling qat_hal_init(), as the latter
> publishes the HAL handle through that pointer. If either
> qat_hal_init() or adf_ae_reset() fails, the error paths free the
> allocation but leave accel_dev->fw_loader pointing at freed memory,
> so the device is left holding a dangling pointer.
> 
> No code path dereferences that stale pointer today. This is therefore
> a robustness improvement with no observable failure behind it, hence
> no Fixes tag.
> 
> Clear accel_dev->fw_loader when the allocation is released, and fold
> the duplicated error handling into a cascading goto chain. Report the
> error returned by the callee rather than a generic -EFAULT;
> adf_dev_init() still maps any failure to -EFAULT, so this is a
> readability improvement and not a functional change.

The -EFAULT in adf_dev_init() should likely also go away: EFAULT means "Bad 
address", i.e. a page could not be accessed. Thus it's likely the wrong 
error code for most cases there.>
> Signed-off-by: Ahsan Atta <ahsan.atta@intel.com>
> Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
> ---
>   .../intel/qat/qat_common/adf_accel_engine.c   | 21 ++++++++++++-------
>   1 file changed, 14 insertions(+), 7 deletions(-)
Anyway, this patch is already a proper step into the right direction, so:

Reviewed-by: Thomas Huth <thuth@redhat.com>

Re: [PATCH] crypto: qat - clear fw_loader pointer on adf_ae_init() failure

[Herbert Xu]

On Tue, Nov 03, 2026 at 10:01:26AM +0000, Ahsan Atta wrote:
> adf_ae_init() stores the newly allocated loader data in
> accel_dev->fw_loader before calling qat_hal_init(), as the latter
> publishes the HAL handle through that pointer. If either
> qat_hal_init() or adf_ae_reset() fails, the error paths free the
> allocation but leave accel_dev->fw_loader pointing at freed memory,
> so the device is left holding a dangling pointer.
> 
> No code path dereferences that stale pointer today. This is therefore
> a robustness improvement with no observable failure behind it, hence
> no Fixes tag.
> 
> Clear accel_dev->fw_loader when the allocation is released, and fold
> the duplicated error handling into a cascading goto chain. Report the
> error returned by the callee rather than a generic -EFAULT;
> adf_dev_init() still maps any failure to -EFAULT, so this is a
> readability improvement and not a functional change.
> 
> Signed-off-by: Ahsan Atta <ahsan.atta@intel.com>
> Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
> ---
>  .../intel/qat/qat_common/adf_accel_engine.c   | 21 ++++++++++++-------
>  1 file changed, 14 insertions(+), 7 deletions(-)

This patch failed to apply for Sashiko, please rebase and
resubmit:

https://sashiko.dev/#/patchset/20261103100126.534424-1-ahsan.atta%40intel.com

Thanks,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [PATCH] crypto: qat - clear fw_loader pointer on adf_ae_init() failure

[Ahsan Atta]

On Fri, Nov 13, 2026 at 12:20:47PM +0100, Thomas Huth wrote:
> Am 03.11.26 um 11:01 schrieb Ahsan Atta:
> > adf_ae_init() stores the newly allocated loader data in
> > accel_dev->fw_loader before calling qat_hal_init(), as the latter
> > publishes the HAL handle through that pointer. If either
> > qat_hal_init() or adf_ae_reset() fails, the error paths free the
> > allocation but leave accel_dev->fw_loader pointing at freed memory,
> > so the device is left holding a dangling pointer.
> > 
> > No code path dereferences that stale pointer today. This is therefore
> > a robustness improvement with no observable failure behind it, hence
> > no Fixes tag.
> > 
> > Clear accel_dev->fw_loader when the allocation is released, and fold
> > the duplicated error handling into a cascading goto chain. Report the
> > error returned by the callee rather than a generic -EFAULT;
> > adf_dev_init() still maps any failure to -EFAULT, so this is a
> > readability improvement and not a functional change.
> 
> The -EFAULT in adf_dev_init() should likely also go away: EFAULT means "Bad
> address", i.e. a page could not be accessed. Thus it's likely the wrong
> error code for most cases there.>

Hi Thomas,
With this patch adf_dev_init() would still return -EFAULT when
adf_ae_init() fails.

        if (adf_ae_init(accel_dev)) {
                dev_err(&GET_DEV(accel_dev),
                        "Failed to initialise Acceleration Engine\n");
                return -EFAULT;
        }
Let me know if you would like me to add your reviewed by tag.

Thanks,
Ahsan Atta

Re: [PATCH] crypto: qat - clear fw_loader pointer on adf_ae_init() failure

[Thomas Huth]

Am 13.11.26 um 15:41 schrieb Ahsan Atta:
> On Fri, Nov 13, 2026 at 12:20:47PM +0100, Thomas Huth wrote:
>> Am 03.11.26 um 11:01 schrieb Ahsan Atta:
>>> adf_ae_init() stores the newly allocated loader data in
>>> accel_dev->fw_loader before calling qat_hal_init(), as the latter
>>> publishes the HAL handle through that pointer. If either
>>> qat_hal_init() or adf_ae_reset() fails, the error paths free the
>>> allocation but leave accel_dev->fw_loader pointing at freed memory,
>>> so the device is left holding a dangling pointer.
>>>
>>> No code path dereferences that stale pointer today. This is therefore
>>> a robustness improvement with no observable failure behind it, hence
>>> no Fixes tag.
>>>
>>> Clear accel_dev->fw_loader when the allocation is released, and fold
>>> the duplicated error handling into a cascading goto chain. Report the
>>> error returned by the callee rather than a generic -EFAULT;
>>> adf_dev_init() still maps any failure to -EFAULT, so this is a
>>> readability improvement and not a functional change.
>>
>> The -EFAULT in adf_dev_init() should likely also go away: EFAULT means "Bad
>> address", i.e. a page could not be accessed. Thus it's likely the wrong
>> error code for most cases there.>
> 
> Hi Thomas,
> With this patch adf_dev_init() would still return -EFAULT when
> adf_ae_init() fails.
> 
>          if (adf_ae_init(accel_dev)) {
>                  dev_err(&GET_DEV(accel_dev),
>                          "Failed to initialise Acceleration Engine\n");
>                  return -EFAULT;
>          }
> Let me know if you would like me to add your reviewed by tag.
Yes, sorry, I didn't meant that you should change this patch here, my 
comment was rather meant as a suggestion for another future patch.

  Thomas