[PATCH net] cxgb4/ch_ktls: disable softirqs around tid_list erases

[PATCH net] cxgb4/ch_ktls: disable softirqs around tid_list erases

[Sang-Hoon Choi]

chcr_ktls_cpl_act_open_rpl() inserts into tid_list from the receive path
using xa_insert_bh().  The array is shared by the adapter's connections
and initialized with XA_FLAGS_LOCK_BH.  However, chcr_ktls_dev_del() and
the chcr_ktls_dev_add() error path use xa_erase(), which takes the XArray
lock without disabling softirqs.

When cleanup runs with softirqs enabled, a receive softirq for another
connection on the same CPU can interrupt the erase and spin on the lock
held by the interrupted task.  Use xa_erase_bh() at both sites to match
the insertion path.

Fixes: 65e302a9bd57 ("cxgb4/ch_ktls: Clear resources when pf4 device is removed")
Reported-by: Changyul Lee <lcy8047@gmail.com>
Assisted-by: LLM
Signed-off-by: Sang-Hoon Choi <csh0052@gmail.com>
---
Compile-tested with x86_64 allmodconfig and W=1.
I have not tested this on Chelsio hardware.

 drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c b/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c
index f5acd4be1e69dcb551758dd27808a1b1eec374bd..dbec95b4977736b9b2fefdf5648a7eaca16429cb 100644
--- a/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c
+++ b/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c
@@ -389,7 +389,7 @@ static void chcr_ktls_dev_del(struct net_device *netdev,
 		cxgb4_remove_tid(&tx_info->adap->tids, tx_info->tx_chan,
 				 tx_info->tid, tx_info->ip_family);
 
-		xa_erase(&u_ctx->tid_list, tx_info->tid);
+		xa_erase_bh(&u_ctx->tid_list, tx_info->tid);
 	}
 
 	port_stats = &tx_info->adap->ch_ktls_stats.ktls_port[tx_info->port_id];
@@ -577,7 +577,7 @@ static int chcr_ktls_dev_add(struct net_device *netdev, struct sock *sk,
 	cxgb4_remove_tid(&tx_info->adap->tids, tx_info->tx_chan,
 			 tx_info->tid, tx_info->ip_family);
 
-	xa_erase(&u_ctx->tid_list, tx_info->tid);
+	xa_erase_bh(&u_ctx->tid_list, tx_info->tid);
 
 put_module:
 	/* release module refcount */
-- 
2.43.0

Re: [PATCH net] cxgb4/ch_ktls: disable softirqs around tid_list erases

[Ayush Sawal]

On 29-09-2026 23:07, Sang-Hoon Choi wrote:
> chcr_ktls_cpl_act_open_rpl() inserts into tid_list from the receive path
> using xa_insert_bh().  The array is shared by the adapter's connections
> and initialized with XA_FLAGS_LOCK_BH.  However, chcr_ktls_dev_del() and
> the chcr_ktls_dev_add() error path use xa_erase(), which takes the XArray
> lock without disabling softirqs.
>
> When cleanup runs with softirqs enabled, a receive softirq for another
> connection on the same CPU can interrupt the erase and spin on the lock
> held by the interrupted task.  Use xa_erase_bh() at both sites to match
> the insertion path.
>
> Fixes: 65e302a9bd57 ("cxgb4/ch_ktls: Clear resources when pf4 device is removed")
> Reported-by: Changyul Lee <lcy8047@gmail.com>
> Assisted-by: LLM
> Signed-off-by: Sang-Hoon Choi <csh0052@gmail.com>
> ---
> Compile-tested with x86_64 allmodconfig and W=1.
> I have not tested this on Chelsio hardware.
>
>   drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c b/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c
> index f5acd4be1e69dcb551758dd27808a1b1eec374bd..dbec95b4977736b9b2fefdf5648a7eaca16429cb 100644
> --- a/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c
> +++ b/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c
> @@ -389,7 +389,7 @@ static void chcr_ktls_dev_del(struct net_device *netdev,
>   		cxgb4_remove_tid(&tx_info->adap->tids, tx_info->tx_chan,
>   				 tx_info->tid, tx_info->ip_family);
>   
> -		xa_erase(&u_ctx->tid_list, tx_info->tid);
> +		xa_erase_bh(&u_ctx->tid_list, tx_info->tid);
>   	}
>   
>   	port_stats = &tx_info->adap->ch_ktls_stats.ktls_port[tx_info->port_id];
> @@ -577,7 +577,7 @@ static int chcr_ktls_dev_add(struct net_device *netdev, struct sock *sk,
>   	cxgb4_remove_tid(&tx_info->adap->tids, tx_info->tx_chan,
>   			 tx_info->tid, tx_info->ip_family);
>   
> -	xa_erase(&u_ctx->tid_list, tx_info->tid);
> +	xa_erase_bh(&u_ctx->tid_list, tx_info->tid);
>   
>   put_module:
>   	/* release module refcount */
Thanks for the patch. Because of the uld_mutex taken in
cxgb4_ktls_dev_add/del, this issue was not coming, but the
change is correct and keeps the locking consistent with
XA_FLAGS_LOCK_BH.

Reviewed-by: Ayush Sawal <ayush.sawal@chelsio.com>

Re: [PATCH net] cxgb4/ch_ktls: disable softirqs around tid_list erases

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by David S. Miller <davem@davemloft.net>:

On Wed, 30 Sep 2026 02:37:34 +0900 you wrote:
> chcr_ktls_cpl_act_open_rpl() inserts into tid_list from the receive path
> using xa_insert_bh().  The array is shared by the adapter's connections
> and initialized with XA_FLAGS_LOCK_BH.  However, chcr_ktls_dev_del() and
> the chcr_ktls_dev_add() error path use xa_erase(), which takes the XArray
> lock without disabling softirqs.
> 
> When cleanup runs with softirqs enabled, a receive softirq for another
> connection on the same CPU can interrupt the erase and spin on the lock
> held by the interrupted task.  Use xa_erase_bh() at both sites to match
> the insertion path.
> 
> [...]

Here is the summary with links:
  - [net] cxgb4/ch_ktls: disable softirqs around tid_list erases
    https://git.kernel.org/netdev/net/c/4c9dc0faca98

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html