When chcr_send_wr() fails in chcr_ahash_finup(), chcr_ahash_final(),
chcr_ahash_update(), or chcr_ahash_digest(), the function still returns
-EINPROGRESS to the crypto layer, claiming the request has been
submitted. No completion callback will be triggered because the work
request was not actually handed over to the hardware, so the
dev->inflight refcount that was incremented by chcr_inc_wrcount() is
never decremented. This permanently prevents device detach and leads
to a resource leak.
Check the return value of chcr_send_wr() and jump to the error unmap
path on failure so that the refcount is properly undone before
returning an error.
Cc: stable@vger.kernel.org
Fixes: 324429d74127 ("chcr: Support for Chelsio's Crypto Hardware")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
drivers/crypto/chelsio/chcr_algo.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/chelsio/chcr_algo.c b/drivers/crypto/chelsio/chcr_algo.c
index 14a708defcd4..142eccaf82fe 100644
--- a/drivers/crypto/chelsio/chcr_algo.c
+++ b/drivers/crypto/chelsio/chcr_algo.c
@@ -1877,7 +1877,10 @@ static int chcr_ahash_finup(struct ahash_request *req)
req_ctx->hctx_wr.processed += params.sg_len;
skb->dev = u_ctx->lldi.ports[0];
set_wr_txq(skb, CPL_PRIORITY_DATA, req_ctx->txqidx);
- chcr_send_wr(skb);
+ if (chcr_send_wr(skb)) {
+ error = -EIO;
+ goto unmap;
+ }
return -EINPROGRESS;
unmap:
chcr_hash_dma_unmap(&u_ctx->lldi.pdev->dev, req);
--
2.34.1