[PATCH] crypto: chelsio - Fix wrcount leak in chcr_aes_decrypt()

[Wentao Liang]

chcr_aes_decrypt() increments the device inflight count with
chcr_inc_wrcount() before building the work request, but it returns
early without dropping the count when the tx queue is full or when
process_cipher() fails and returns no skb. The count is only dropped
by the completion handlers, so every failed request permanently skews
the count and eventually blocks the device from being detached, with
the detach worker warning "CHCR:request Still Pending".

Add an error label that calls chcr_dec_wrcount(), mirroring
chcr_aes_encrypt(), and jump to it on the failure paths.

Fixes: fef4912b66d6 ("crypto: chelsio - Handle PCI shutdown event")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/crypto/chelsio/chcr_algo.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/crypto/chelsio/chcr_algo.c b/drivers/crypto/chelsio/chcr_algo.c
index eece1ac1085a..6fd25c54aa1e 100644
--- a/drivers/crypto/chelsio/chcr_algo.c
+++ b/drivers/crypto/chelsio/chcr_algo.c
@@ -1396,17 +1396,22 @@ static int chcr_aes_decrypt(struct skcipher_request *req)
 		return -ENXIO;
 
 	if (unlikely(cxgb4_is_crypto_q_full(u_ctx->lldi.ports[0],
-						reqctx->txqidx) &&
-		(!(req->base.flags & CRYPTO_TFM_REQ_MAY_BACKLOG))))
-			return -ENOSPC;
+					    reqctx->txqidx) &&
+	    (!(req->base.flags & CRYPTO_TFM_REQ_MAY_BACKLOG)))) {
+		err = -ENOSPC;
+		goto error;
+	}
 	err = process_cipher(req, u_ctx->lldi.rxq_ids[reqctx->rxqidx],
 			     &skb, CHCR_DECRYPT_OP);
 	if (err || !skb)
-		return err;
+		goto error;
 	skb->dev = u_ctx->lldi.ports[0];
 	set_wr_txq(skb, CPL_PRIORITY_DATA, reqctx->txqidx);
 	chcr_send_wr(skb);
 	return -EINPROGRESS;
+error:
+	chcr_dec_wrcount(dev);
+	return err;
 }
 static int chcr_device_init(struct chcr_context *ctx)
 {
-- 
2.34.1