Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 266ee00f authored by Ayush Sawal's avatar Ayush Sawal Committed by Greg Kroah-Hartman
Browse files

chtls: Fix hardware tid leak 



[ Upstream commit 717df0f4cdc9044c415431a3522b3e9ccca5b4a3 ]

send_abort_rpl() is not calculating cpl_abort_req_rss offset and
ends up sending wrong TID with abort_rpl WR causng tid leaks.
Replaced send_abort_rpl() with chtls_send_abort_rpl() as it is
redundant.

Fixes: cc35c88a ("crypto : chtls - CPL handler definition")
Signed-off-by: default avatarRohit Maheshwari <rohitm@chelsio.com>
Signed-off-by: default avatarAyush Sawal <ayush.sawal@chelsio.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ed62af62

drivers/crypto/chelsio/chtls/chtls_cm.c

+3 −36
Original line number Diff line number Diff line
@@ -1828,39 +1828,6 @@ static void send_defer_abort_rpl(struct chtls_dev *cdev, struct sk_buff *skb) 
	kfree_skb(skb);

}



static void send_abort_rpl(struct sock *sk, struct sk_buff *skb,

			   struct chtls_dev *cdev, int status, int queue)

{

	struct cpl_abort_req_rss *req = cplhdr(skb);

	struct sk_buff *reply_skb;

	struct chtls_sock *csk;



	csk = rcu_dereference_sk_user_data(sk);



	reply_skb = alloc_skb(sizeof(struct cpl_abort_rpl),

			      GFP_KERNEL);



	if (!reply_skb) {

		req->status = (queue << 1);

		send_defer_abort_rpl(cdev, skb);

		return;

	}



	set_abort_rpl_wr(reply_skb, GET_TID(req), status);

	kfree_skb(skb);



	set_wr_txq(reply_skb, CPL_PRIORITY_DATA, queue);

	if (csk_conn_inline(csk)) {

		struct l2t_entry *e = csk->l2t_entry;



		if (e && sk->sk_state != TCP_SYN_RECV) {

			cxgb4_l2t_send(csk->egress_dev, reply_skb, e);

			return;

		}

	}

	cxgb4_ofld_send(cdev->lldi->ports[0], reply_skb);

}



/*

 * Add an skb to the deferred skb queue for processing from process context.

 */
@@ -1924,7 +1891,7 @@ static void bl_abort_syn_rcv(struct sock *lsk, struct sk_buff *skb) 


	skb->sk	= NULL;

	do_abort_syn_rcv(child, lsk);

	send_abort_rpl(child, skb, BLOG_SKB_CB(skb)->cdev,

	chtls_send_abort_rpl(child, skb, BLOG_SKB_CB(skb)->cdev,

			     CPL_ABORT_NO_RST, queue);

}
@@ -1956,7 +1923,7 @@ static int abort_syn_rcv(struct sock *sk, struct sk_buff *skb) 
		int queue = csk->txq_idx;



		do_abort_syn_rcv(sk, psk);

		send_abort_rpl(sk, skb, cdev, CPL_ABORT_NO_RST, queue);

		chtls_send_abort_rpl(sk, skb, cdev, CPL_ABORT_NO_RST, queue);

	} else {

		skb->sk = sk;

		BLOG_SKB_CB(skb)->backlog_rcv = bl_abort_syn_rcv;