chcr_aes_decrypt() increments the device inflight count with chcr_inc_wrcount() before building the work request, but it returns early without dropping the count when the tx queue is full or when process_cipher() fails and returns no skb. The count is only dropped by the completion handlers, so every failed request permanently skews the count and eventually blocks the device from being detached, with the detach worker warning "CHCR:request Still Pending". Add an error label that calls chcr_dec_wrcount(), mirroring chcr_aes_encrypt(), and jump to it on the failure paths. Fixes: fef4912b66d6 ("crypto: chelsio - Handle PCI shutdown event") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang --- drivers/crypto/chelsio/chcr_algo.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/drivers/crypto/chelsio/chcr_algo.c b/drivers/crypto/chelsio/chcr_algo.c index eece1ac1085a..6fd25c54aa1e 100644 --- a/drivers/crypto/chelsio/chcr_algo.c +++ b/drivers/crypto/chelsio/chcr_algo.c @@ -1396,17 +1396,22 @@ static int chcr_aes_decrypt(struct skcipher_request *req) return -ENXIO; if (unlikely(cxgb4_is_crypto_q_full(u_ctx->lldi.ports[0], - reqctx->txqidx) && - (!(req->base.flags & CRYPTO_TFM_REQ_MAY_BACKLOG)))) - return -ENOSPC; + reqctx->txqidx) && + (!(req->base.flags & CRYPTO_TFM_REQ_MAY_BACKLOG)))) { + err = -ENOSPC; + goto error; + } err = process_cipher(req, u_ctx->lldi.rxq_ids[reqctx->rxqidx], &skb, CHCR_DECRYPT_OP); if (err || !skb) - return err; + goto error; skb->dev = u_ctx->lldi.ports[0]; set_wr_txq(skb, CPL_PRIORITY_DATA, reqctx->txqidx); chcr_send_wr(skb); return -EINPROGRESS; +error: + chcr_dec_wrcount(dev); + return err; } static int chcr_device_init(struct chcr_context *ctx) { -- 2.34.1