[PATCH] crypto: chelsio - Fix wrcount leak in chcr_aes_decrypt()

[PATCH] crypto: chelsio - Fix wrcount leak in chcr_aes_decrypt()

[Wentao Liang]

chcr_aes_decrypt() increments the device inflight count with
chcr_inc_wrcount() before building the work request, but it returns
early without dropping the count when the tx queue is full or when
process_cipher() fails and returns no skb. The count is only dropped
by the completion handlers, so every failed request permanently skews
the count and eventually blocks the device from being detached, with
the detach worker warning "CHCR:request Still Pending".

Add an error label that calls chcr_dec_wrcount(), mirroring
chcr_aes_encrypt(), and jump to it on the failure paths.

Fixes: fef4912b66d6 ("crypto: chelsio - Handle PCI shutdown event")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/crypto/chelsio/chcr_algo.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/crypto/chelsio/chcr_algo.c b/drivers/crypto/chelsio/chcr_algo.c
index eece1ac1085a..6fd25c54aa1e 100644
--- a/drivers/crypto/chelsio/chcr_algo.c
+++ b/drivers/crypto/chelsio/chcr_algo.c
@@ -1396,17 +1396,22 @@ static int chcr_aes_decrypt(struct skcipher_request *req)
 		return -ENXIO;
 
 	if (unlikely(cxgb4_is_crypto_q_full(u_ctx->lldi.ports[0],
-						reqctx->txqidx) &&
-		(!(req->base.flags & CRYPTO_TFM_REQ_MAY_BACKLOG))))
-			return -ENOSPC;
+					    reqctx->txqidx) &&
+	    (!(req->base.flags & CRYPTO_TFM_REQ_MAY_BACKLOG)))) {
+		err = -ENOSPC;
+		goto error;
+	}
 	err = process_cipher(req, u_ctx->lldi.rxq_ids[reqctx->rxqidx],
 			     &skb, CHCR_DECRYPT_OP);
 	if (err || !skb)
-		return err;
+		goto error;
 	skb->dev = u_ctx->lldi.ports[0];
 	set_wr_txq(skb, CPL_PRIORITY_DATA, reqctx->txqidx);
 	chcr_send_wr(skb);
 	return -EINPROGRESS;
+error:
+	chcr_dec_wrcount(dev);
+	return err;
 }
 static int chcr_device_init(struct chcr_context *ctx)
 {
-- 
2.34.1

Re: [PATCH] crypto: chelsio - Fix wrcount leak in chcr_aes_decrypt()

[Herbert Xu]

On Wed, Sep 16, 2026 at 09:23:59AM +0000, Wentao Liang wrote:
> chcr_aes_decrypt() increments the device inflight count with
> chcr_inc_wrcount() before building the work request, but it returns
> early without dropping the count when the tx queue is full or when
> process_cipher() fails and returns no skb. The count is only dropped
> by the completion handlers, so every failed request permanently skews
> the count and eventually blocks the device from being detached, with
> the detach worker warning "CHCR:request Still Pending".
> 
> Add an error label that calls chcr_dec_wrcount(), mirroring
> chcr_aes_encrypt(), and jump to it on the failure paths.
> 
> Fixes: fef4912b66d6 ("crypto: chelsio - Handle PCI shutdown event")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/crypto/chelsio/chcr_algo.c | 13 +++++++++----
>  1 file changed, 9 insertions(+), 4 deletions(-)

Plesae combine this with the encrypt patch and repost.

Thanks,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt