[PATCH 08/14] vhost/crypto: drop crypto session cache

[Maxime Coquelin]

From: David Marchand <david.marchand at redhat.com>

The session cache may get invalidated by a guest, which would then
request an operation on the same (cached) session.

In general, the cache itself is racy as there is no guarantee a session
gets closed on the same thread that is processing a crypto request.

For those reasons, drop the cache entirely.

CVE-2026-86845
Bugzilla ID: 2028

Fixes: 939066d96563 ("vhost/crypto: add public function implementation")
Cc: stable at dpdk.org

Acked-by: Bruce Richardson <bruce.richardson at intel.com>
Signed-off-by: David Marchand <david.marchand at redhat.com>
---
 lib/vhost/vhost_crypto.c | 48 +++++++++++++---------------------------
 1 file changed, 15 insertions(+), 33 deletions(-)

diff --git a/lib/vhost/vhost_crypto.c b/lib/vhost/vhost_crypto.c
index bba2e1c0a6..a072324083 100644
--- a/lib/vhost/vhost_crypto.c
+++ b/lib/vhost/vhost_crypto.c
@@ -216,10 +216,6 @@ struct __rte_cache_aligned vhost_crypto {
 
 	uint64_t last_session_id;
 
-	uint64_t cache_sym_session_id;
-	struct rte_cryptodev_sym_session *cache_sym_session;
-	uint64_t cache_asym_session_id;
-	struct rte_cryptodev_asym_session *cache_asym_session;
 	/** socket id for the device */
 	int socket_id;
 
@@ -1590,22 +1586,16 @@ vhost_crypto_process_one_req(struct vhost_crypto *vcrypto,
 		memcpy(vc_req_out, vc_req, sizeof(struct vhost_crypto_data_req));
 		session_id = req.header.session_id;
 
-		/* one branch to avoid unnecessary table lookup */
-		if (vcrypto->cache_sym_session_id != session_id) {
-			err = rte_hash_lookup_data(vcrypto->session_map,
-					&session_id, (void **)&vhost_session);
-			if (unlikely(err < 0)) {
-				err = VIRTIO_CRYPTO_ERR;
-				VC_LOG_ERR("Failed to find session %"PRIu64,
+		err = rte_hash_lookup_data(vcrypto->session_map,
+				&session_id, (void **)&vhost_session);
+		if (unlikely(err < 0)) {
+			err = VIRTIO_CRYPTO_ERR;
+			VC_LOG_ERR("Failed to find session %"PRIu64,
 						session_id);
-				goto error_exit;
-			}
-
-			vcrypto->cache_sym_session = vhost_session->sym;
-			vcrypto->cache_sym_session_id = session_id;
+			goto error_exit;
 		}
 
-		sym_session = vcrypto->cache_sym_session;
+		sym_session = vhost_session->sym;
 		op->type = RTE_CRYPTO_OP_TYPE_SYMMETRIC;
 
 		err = rte_crypto_op_attach_sym_session(op, sym_session);
@@ -1641,22 +1631,16 @@ vhost_crypto_process_one_req(struct vhost_crypto *vcrypto,
 	case VIRTIO_CRYPTO_AKCIPHER_DECRYPT:
 		session_id = req.header.session_id;
 
-		/* one branch to avoid unnecessary table lookup */
-		if (vcrypto->cache_asym_session_id != session_id) {
-			err = rte_hash_lookup_data(vcrypto->session_map,
-					&session_id, (void **)&vhost_session);
-			if (unlikely(err < 0)) {
-				err = VIRTIO_CRYPTO_ERR;
-				VC_LOG_ERR("Failed to find asym session %"PRIu64,
-						   session_id);
-				goto error_exit;
-			}
-
-			vcrypto->cache_asym_session = vhost_session->asym;
-			vcrypto->cache_asym_session_id = session_id;
+		err = rte_hash_lookup_data(vcrypto->session_map,
+				&session_id, (void **)&vhost_session);
+		if (unlikely(err < 0)) {
+			err = VIRTIO_CRYPTO_ERR;
+			VC_LOG_ERR("Failed to find asym session %"PRIu64,
+					   session_id);
+			goto error_exit;
 		}
 
-		asym_session = vcrypto->cache_asym_session;
+		asym_session = vhost_session->asym;
 		op->type = RTE_CRYPTO_OP_TYPE_ASYMMETRIC;
 
 		err = rte_crypto_op_attach_asym_session(op, asym_session);
@@ -1834,8 +1818,6 @@ rte_vhost_crypto_create(int vid, uint8_t cryptodev_id,
 
 	vcrypto->sess_pool = sess_pool;
 	vcrypto->cid = cryptodev_id;
-	vcrypto->cache_sym_session_id = UINT64_MAX;
-	vcrypto->cache_asym_session_id = UINT64_MAX;
 	vcrypto->last_session_id = 1;
 	vcrypto->dev = dev;
 	vcrypto->option = RTE_VHOST_CRYPTO_ZERO_COPY_DISABLE;
-- 
2.56.0