From: Ciara Power Date: Wed, 21 Jul 2021 12:51:22 +0000 (+0000) Subject: cryptodev: fix freeing after device release X-Git-Url: http://git.droids-corp.org/?a=commitdiff_plain;h=eeaeca82b8cbd6599bafd4029aad5ce4dedff7a2;p=dpdk.git cryptodev: fix freeing after device release The PMD destroy function was calling the release function, which frees cryptodev->data, and then tries to free cryptodev->data->dev_private, which causes the heap use after free issue. A temporary pointer is set before the free of cryptodev->data, which can then be used afterwards to free dev_private. The free cannot be moved to before the release function is called, as dev_private is used in the PMD close function while being released. Fixes: 9e6edea41805 ("cryptodev: add APIs to assist PMD initialisation") Cc: stable@dpdk.org Reported-by: Zhihong Peng Signed-off-by: Ciara Power Acked-by: Akhil Goyal --- diff --git a/lib/cryptodev/rte_cryptodev_pmd.c b/lib/cryptodev/rte_cryptodev_pmd.c index 0912004127..e342daabc4 100644 --- a/lib/cryptodev/rte_cryptodev_pmd.c +++ b/lib/cryptodev/rte_cryptodev_pmd.c @@ -140,6 +140,7 @@ int rte_cryptodev_pmd_destroy(struct rte_cryptodev *cryptodev) { int retval; + void *dev_priv = cryptodev->data->dev_private; CDEV_LOG_INFO("Closing crypto device %s", cryptodev->device->name); @@ -149,7 +150,7 @@ rte_cryptodev_pmd_destroy(struct rte_cryptodev *cryptodev) return retval; if (rte_eal_process_type() == RTE_PROC_PRIMARY) - rte_free(cryptodev->data->dev_private); + rte_free(dev_priv); cryptodev->device = NULL;