Patch "crypto: qat - extend scope of lock in adf_cfg_add_key_value_param()" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    crypto: qat - extend scope of lock in adf_cfg_add_key_value_param()

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     crypto-qat-extend-scope-of-lock-in-adf_cfg_add_key_v.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 99b152723620d8ad7683c6e246fd53404aa63763
Author: Nivas Varadharajan Mugunthakumar <nivasx.varadharajan.mugunthakumar@xxxxxxxxx>
Date:   Tue Jun 25 15:38:50 2024 +0100

    crypto: qat - extend scope of lock in adf_cfg_add_key_value_param()
    
    [ Upstream commit 6424da7d8b938fe66e7e771eaa949bc7b6c29c00 ]
    
    The function adf_cfg_add_key_value_param() attempts to access and modify
    the key value store of the driver without locking.
    
    Extend the scope of cfg->lock to avoid a potential race condition.
    
    Fixes: 92bf269fbfe9 ("crypto: qat - change behaviour of adf_cfg_add_key_value_param()")
    Signed-off-by: Nivas Varadharajan Mugunthakumar <nivasx.varadharajan.mugunthakumar@xxxxxxxxx>
    Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@xxxxxxxxx>
    Signed-off-by: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/crypto/intel/qat/qat_common/adf_cfg.c b/drivers/crypto/intel/qat/qat_common/adf_cfg.c
index 8836f015c39c4..2cf102ad4ca82 100644
--- a/drivers/crypto/intel/qat/qat_common/adf_cfg.c
+++ b/drivers/crypto/intel/qat/qat_common/adf_cfg.c
@@ -290,17 +290,19 @@ int adf_cfg_add_key_value_param(struct adf_accel_dev *accel_dev,
 	 * 3. if the key exists with the same value, then return without doing
 	 *    anything (the newly created key_val is freed).
 	 */
+	down_write(&cfg->lock);
 	if (!adf_cfg_key_val_get(accel_dev, section_name, key, temp_val)) {
 		if (strncmp(temp_val, key_val->val, sizeof(temp_val))) {
 			adf_cfg_keyval_remove(key, section);
 		} else {
 			kfree(key_val);
-			return 0;
+			goto out;
 		}
 	}
 
-	down_write(&cfg->lock);
 	adf_cfg_keyval_add(key_val, section);
+
+out:
 	up_write(&cfg->lock);
 	return 0;
 }