Re: [RFC net-next 1/7] net/mlx5e: kTLS, Hold a dropped skb until its posted WQEs complete

[sashiko-bot@kernel.org]

> mlx5e_ktls_del_tx() releases a TX connection's TIS and DEK with no
> completion tracking: the DEK is destroyed, and the TIS is returned to
> the recycling pool, right away. This relies on the socket lifetime:
> tls_dev_del() is called only once the socket is destructed, i.e. after
> sk_wmem_alloc drained, so every skb of the connection was completed,
> and with it every WQE posted ahead of it on the same SQ; or from
> tls_device_down(), after the channels were closed.
> 
> This does not cover the error path: an skb can be dropped after
> parameter or DUMP WQEs were posted on its behalf, in the kTLS TX
> handling, or when DMA mapping for its SEND fails. These WQEs request
> no completion of their own and hold no socket memory, so freeing the
> skb can let the socket be destructed while they are pending. The TIS
> can then be handed to another connection, and the DEK destroyed,
> before they execute.
> [ ... ]
> drops released none early.
> 
> Fixes: d2ead1f360e8 ("net/mlx5e: Add kTLS TX HW offload support")
> Link: https://lore.kernel.org/netdev/20261022181751.1349984-1-rjethwani@purestorage.com/
> Signed-off-by: Tariq Toukan <tariqt@nvidia.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109114734.2087878-1-tariqt@nvidia.com?part=1