[PATCH] crypto: chcr - Balance inflight count on invalid RFC4106 AAD length

[Wentao Liang]

chcr_aead_op() increments the device inflight counter before checking
the RFC4106 associated data length. If the length is invalid, it returns
-EINVAL without submitting a request or decrementing the counter. No
completion can balance that increment, so device teardown keeps seeing
an outstanding request.

Decrement the counter before returning from this validation failure,
matching the other synchronous error exits after chcr_inc_wrcount().

Fixes: d91a3159e8d9 ("Crypto/chcr: fix gcm-aes and rfc4106-gcm failed tests")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/crypto/chelsio/chcr_algo.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/crypto/chelsio/chcr_algo.c b/drivers/crypto/chelsio/chcr_algo.c
index fd4720fa50a9..ac4e40d5292c 100644
--- a/drivers/crypto/chelsio/chcr_algo.c
+++ b/drivers/crypto/chelsio/chcr_algo.c
@@ -3651,6 +3651,7 @@ static int chcr_aead_op(struct aead_request *req,
 	    crypto_ipsec_check_assoclen(req->assoclen) != 0) {
 		pr_err("RFC4106: Invalid value of assoclen %d\n",
 		       req->assoclen);
+		chcr_dec_wrcount(cdev);
 		return -EINVAL;
 	}
 
-- 
2.34.1