[PATCH 2/2] net/mlx5e: kTLS: guard RX resync against stale channel index

[Rishikesh Jethwani <rjethwani@purestorage.com>]

An RX offloaded socket stores its channel index in priv_rx->rxq when
offload is enabled. If the channel count later shrinks, e.g. via
'ethtool -L <dev> combined N', existing offloaded sockets can still
carry a queue index from the old channel layout.

The kTLS RX resync paths index priv->channels.c[priv_rx->rxq] directly
in both resync_handle_work() and mlx5e_ktls_rx_resync(). After channel
reduction, a stale priv_rx->rxq can be out of range for the current
priv->channels.num and lead to invalid channel access.

Guard both resync sites with a bounds check on priv_rx->rxq and bail out
gracefully when the stored queue no longer exists. Account the skipped
request and, in the workqueue path, cancel the async resync request and
drop the reference taken when the work item was queued.

This complements the previous add-path fix, which rejects stale RXQ
mappings during offload setup. Existing offloaded sockets still need
protection in the resync callbacks after a channel-count reduction.

Fixes: 1182f3659357 ("net/mlx5e: kTLS, Add kTLS RX HW offload support")
Link: https://lore.kernel.org/netdev/20260627210635.89769-1-nils.juenemann@gmail.com/
Reported-by: Nils Juenemann <nils.juenemann@gmail.com>
Tested-by: Nils Juenemann <nils.juenemann@gmail.com>
Signed-off-by: Rishikesh Jethwani <rjethwani@purestorage.com>
---
 .../ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c    | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c
index 232e998a8f24..c0676148a36e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c
@@ -343,6 +343,13 @@ static void resync_handle_work(struct work_struct *work)
 		return;
 	}
 
+	if (unlikely(priv_rx->rxq >= resync->priv->channels.num)) {
+		priv_rx->rq_stats->tls_resync_req_skip++;
+		tls_offload_rx_resync_async_request_cancel(&resync->core);
+		mlx5e_ktls_priv_rx_put(priv_rx);
+		return;
+	}
+
 	c = resync->priv->channels.c[priv_rx->rxq];
 	sq = c->async_icosq;
 
@@ -568,6 +575,10 @@ void mlx5e_ktls_rx_resync(struct net_device *netdev, struct sock *sk,
 	resync->seq = seq;
 
 	priv = netdev_priv(netdev);
+	if (unlikely(priv_rx->rxq >= priv->channels.num)) {
+		priv_rx->rq_stats->tls_resync_req_skip++;
+		return;
+	}
 	c = priv->channels.c[priv_rx->rxq];
 
 	resync_handle_seq_match(priv_rx, c);
-- 
2.25.1