Re: [PATCH] crypto: chelsio: fix refcount leaks in ahash request functions

[Herbert Xu]

On Thu, Jun 04, 2026 at 10:13:08AM +0000, Wentao Liang wrote:
> When chcr_send_wr() fails in chcr_ahash_finup(), chcr_ahash_final(),
> chcr_ahash_update(), or chcr_ahash_digest(), the function still returns
> -EINPROGRESS to the crypto layer, claiming the request has been
> submitted.  No completion callback will be triggered because the work
> request was not actually handed over to the hardware, so the
> dev->inflight refcount that was incremented by chcr_inc_wrcount() is
> never decremented.  This permanently prevents device detach and leads
> to a resource leak.
> 
> Check the return value of chcr_send_wr() and jump to the error unmap
> path on failure so that the refcount is properly undone before
> returning an error.
> 
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: 324429d74127 ("chcr: Support for Chelsio's Crypto Hardware")
> Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
> ---
>  drivers/crypto/chelsio/chcr_algo.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/crypto/chelsio/chcr_algo.c b/drivers/crypto/chelsio/chcr_algo.c
> index 14a708defcd4..142eccaf82fe 100644
> --- a/drivers/crypto/chelsio/chcr_algo.c
> +++ b/drivers/crypto/chelsio/chcr_algo.c
> @@ -1877,7 +1877,10 @@ static int chcr_ahash_finup(struct ahash_request *req)
>  	req_ctx->hctx_wr.processed += params.sg_len;
>  	skb->dev = u_ctx->lldi.ports[0];
>  	set_wr_txq(skb, CPL_PRIORITY_DATA, req_ctx->txqidx);
> -	chcr_send_wr(skb);
> +	if (chcr_send_wr(skb)) {
> +		error = -EIO;
> +		goto unmap;
> +	}

This call is made half a dozen times in this file so fixing one
of them is not going to make much of a difference.  Either fix them
all or just mark this driver as broken.

Thanks,
-- 
Email: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt