Skip to content

Commit

Permalink
chtls: Fix hardware tid leak
Browse files Browse the repository at this point in the history
[ Upstream commit 717df0f ]

send_abort_rpl() is not calculating cpl_abort_req_rss offset and
ends up sending wrong TID with abort_rpl WR causng tid leaks.
Replaced send_abort_rpl() with chtls_send_abort_rpl() as it is
redundant.

Fixes: cc35c88 ("crypto : chtls - CPL handler definition")
Signed-off-by: Rohit Maheshwari <rohitm@chelsio.com>
Signed-off-by: Ayush Sawal <ayush.sawal@chelsio.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
ayushsawl authored and gregkh committed Jan 17, 2021
1 parent b0ff6d0 commit 694635a
Showing 1 changed file with 3 additions and 36 deletions.
39 changes: 3 additions & 36 deletions drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c
Expand Up @@ -1996,39 +1996,6 @@ static void t4_defer_reply(struct sk_buff *skb, struct chtls_dev *cdev,
spin_unlock_bh(&cdev->deferq.lock);
}

static void send_abort_rpl(struct sock *sk, struct sk_buff *skb,
struct chtls_dev *cdev, int status, int queue)
{
struct cpl_abort_req_rss *req = cplhdr(skb);
struct sk_buff *reply_skb;
struct chtls_sock *csk;

csk = rcu_dereference_sk_user_data(sk);

reply_skb = alloc_skb(sizeof(struct cpl_abort_rpl),
GFP_KERNEL);

if (!reply_skb) {
req->status = (queue << 1);
t4_defer_reply(skb, cdev, send_defer_abort_rpl);
return;
}

set_abort_rpl_wr(reply_skb, GET_TID(req), status);
kfree_skb(skb);

set_wr_txq(reply_skb, CPL_PRIORITY_DATA, queue);
if (csk_conn_inline(csk)) {
struct l2t_entry *e = csk->l2t_entry;

if (e && sk->sk_state != TCP_SYN_RECV) {
cxgb4_l2t_send(csk->egress_dev, reply_skb, e);
return;
}
}
cxgb4_ofld_send(cdev->lldi->ports[0], reply_skb);
}

static void chtls_send_abort_rpl(struct sock *sk, struct sk_buff *skb,
struct chtls_dev *cdev,
int status, int queue)
Expand Down Expand Up @@ -2078,8 +2045,8 @@ static void bl_abort_syn_rcv(struct sock *lsk, struct sk_buff *skb)

skb->sk = NULL;
do_abort_syn_rcv(child, lsk);
send_abort_rpl(child, skb, BLOG_SKB_CB(skb)->cdev,
CPL_ABORT_NO_RST, queue);
chtls_send_abort_rpl(child, skb, BLOG_SKB_CB(skb)->cdev,
CPL_ABORT_NO_RST, queue);
}

static int abort_syn_rcv(struct sock *sk, struct sk_buff *skb)
Expand Down Expand Up @@ -2110,7 +2077,7 @@ static int abort_syn_rcv(struct sock *sk, struct sk_buff *skb)
int queue = csk->txq_idx;

do_abort_syn_rcv(sk, psk);
send_abort_rpl(sk, skb, cdev, CPL_ABORT_NO_RST, queue);
chtls_send_abort_rpl(sk, skb, cdev, CPL_ABORT_NO_RST, queue);
} else {
skb->sk = sk;
BLOG_SKB_CB(skb)->backlog_rcv = bl_abort_syn_rcv;
Expand Down

0 comments on commit 694635a

Please sign in to comment.