[PATCH] crypto: chelsio - Fix wrcount leak in chcr_aes_encrypt()
From: Wentao Liang
Date: Wed Sep 16 2026 - 05:32:07 EST
chcr_aes_encrypt() increments the device inflight count with
chcr_inc_wrcount() before building the work request, but when
process_cipher() fails or returns no skb the request is simply
abandoned with the inflight count still elevated. The count is only
dropped on the queue-full error path and by the completion handlers,
so every failed request permanently skews the count and eventually
blocks the device from being detached, with the detach worker warning
"CHCR:request Still Pending".
Jump to the existing error label that calls chcr_dec_wrcount() so the
inflight count is dropped when the request fails.
Fixes: fef4912b66d6 ("crypto: chelsio - Handle PCI shutdown event")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
drivers/crypto/chelsio/chcr_algo.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/chelsio/chcr_algo.c b/drivers/crypto/chelsio/chcr_algo.c
index 6dec42282768..eece1ac1085a 100644
--- a/drivers/crypto/chelsio/chcr_algo.c
+++ b/drivers/crypto/chelsio/chcr_algo.c
@@ -1359,7 +1359,7 @@ static int chcr_aes_encrypt(struct skcipher_request *req)
err = process_cipher(req, u_ctx->lldi.rxq_ids[reqctx->rxqidx],
&skb, CHCR_ENCRYPT_OP);
if (err || !skb)
- return err;
+ goto error;
skb->dev = u_ctx->lldi.ports[0];
set_wr_txq(skb, CPL_PRIORITY_DATA, reqctx->txqidx);
chcr_send_wr(skb);
--
2.34.1