Code changes to avoid a potential race condition.

Changes to both qat_crypto_callbackFn() and qat_chained_callbackFn() to avoid the potential race condition of an object passed in by reference to the callback functions being subsequently cleaned up before the callback functions have completed their use of it. Change-Id: I4500205153d6c97d75ac00998d7f6c9499199721 Signed-off-by: Steve Linsell <[email protected]>
jmagnin · Jul 11, 2019 · d2f59b4 · d2f59b4
1 parent 37ac7da
commit d2f59b4
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 7 deletions.
diff --git a/qat_callback.c b/qat_callback.c
@@ -189,6 +189,7 @@ void qat_crypto_callbackFn(void *callbackTag, CpaStatus status,
                            CpaBufferList * pDstBuffer,
                            CpaBoolean verifyResult)
 {
+    ASYNC_JOB *job = NULL;
     op_done_t *opDone = (op_done_t *)callbackTag;
 
     if (unlikely(opDone == NULL)) {
@@ -202,10 +203,13 @@ void qat_crypto_callbackFn(void *callbackTag, CpaStatus status,
                             ? CPA_TRUE : CPA_FALSE;
     opDone->status = status;
 
-    if (opDone->job) {
-        opDone->flag = 1;
-        qat_wake_job(opDone->job, ASYNC_STATUS_OK);
-    } else {
-        opDone->flag = 1;
+    /* Cache job pointer to avoid a race condition if opDone gets cleaned up
+     * in the calling thread.
+     */
+    job = (ASYNC_JOB *)opDone->job;
+
+    opDone->flag = 1;
+    if (job) {
+        qat_wake_job(job, ASYNC_STATUS_OK);
     }
 }
diff --git a/qat_ciphers.c b/qat_ciphers.c
@@ -416,6 +416,7 @@ static void qat_chained_callbackFn(void *callbackTag, CpaStatus status,
                                    void *pOpData, CpaBufferList *pDstBuffer,
                                    CpaBoolean verifyResult)
 {
+    ASYNC_JOB *job = NULL;
     op_done_pipe_t *opdone = (op_done_pipe_t *)callbackTag;
     CpaBoolean res = CPA_FALSE;
 
@@ -450,12 +451,17 @@ static void qat_chained_callbackFn(void *callbackTag, CpaStatus status,
         QAT_ATOMIC_DEC(num_cipher_pipeline_requests_in_flight);
     }
 
+    /* Cache job pointer to avoid a race condition if opdone gets cleaned up
+     * in the calling thread.
+     */
+    job = (ASYNC_JOB *)opdone->opDone.job;
+
     /* Mark job as done when all the requests have been submitted and
      * subsequently processed.
      */
     opdone->opDone.flag = 1;
-    if (opdone->opDone.job) {
-        qat_wake_job(opdone->opDone.job, ASYNC_STATUS_OK);
+    if (job) {
+       qat_wake_job(job, ASYNC_STATUS_OK);
     }
 }