]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
crypto: qat - protect service table iterations with service_lock
authorAhsan Atta <ahsan.atta@intel.com>
Wed, 20 May 2026 12:41:55 +0000 (13:41 +0100)
committerHerbert Xu <herbert@gondor.apana.org.au>
Fri, 29 May 2026 06:05:29 +0000 (14:05 +0800)
commit5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e
tree4686f96b6122a124ab68cd1de96fb4d26e9b0fbb
parent7d3ed20f7e46b3e991936fedd7a28f3ff4aec8d2
crypto: qat - protect service table iterations with service_lock

The service_table list is protected by service_lock when entries are
added or removed (in adf_service_add() and adf_service_remove()), but
several functions iterate over the list without holding this lock.

A concurrent adf_service_register() or adf_service_unregister() call
could modify the list during traversal, leading to list corruption or
a use-after-free.

Fix this by holding service_lock across all list_for_each_entry()
iterations of service_table in adf_dev_init(), adf_dev_start(),
adf_dev_stop(), adf_dev_shutdown(), adf_dev_restarting_notify(),
adf_dev_restarted_notify(), and adf_error_notifier().

The lock ordering is safe: callers of the static helpers (adf_dev_up()
and adf_dev_down()) acquire state_lock before service_lock, and no
event_hld callback or service_lock holder ever acquires state_lock in
the reverse order.

Cc: stable@vger.kernel.org
Fixes: d8cba25d2c68 ("crypto: qat - Intel(R) QAT driver framework")
Signed-off-by: Ahsan Atta <ahsan.atta@intel.com>
Co-developed-by: Maksim Lukoshkov <maksim.lukoshkov@intel.com>
Signed-off-by: Maksim Lukoshkov <maksim.lukoshkov@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
drivers/crypto/intel/qat/qat_common/adf_init.c