This is a note to let you know that I've just added the patch titled ch_ktls: Fix kernel panic to the 5.11-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ch_ktls-fix-kernel-panic.patch and it can be found in the queue-5.11 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 1a73e427b824133940c2dd95ebe26b6dce1cbf10 Mon Sep 17 00:00:00 2001 From: Vinay Kumar Yadav <vinay.yadav@xxxxxxxxxxx> Date: Thu, 15 Apr 2021 13:17:45 +0530 Subject: ch_ktls: Fix kernel panic From: Vinay Kumar Yadav <vinay.yadav@xxxxxxxxxxx> commit 1a73e427b824133940c2dd95ebe26b6dce1cbf10 upstream. Taking page refcount is not ideal and causes kernel panic sometimes. It's better to take tx_ctx lock for the complete skb transmit, to avoid page cleanup if ACK received in middle. Fixes: 5a4b9fe7fece ("cxgb4/chcr: complete record tx handling") Signed-off-by: Vinay Kumar Yadav <vinay.yadav@xxxxxxxxxxx> Signed-off-by: Rohit Maheshwari <rohitm@xxxxxxxxxxx> Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c | 24 ++-------- 1 file changed, 5 insertions(+), 19 deletions(-) --- a/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c +++ b/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c @@ -2015,12 +2015,11 @@ static int chcr_ktls_xmit(struct sk_buff * we will send the complete record again. */ + spin_lock_irqsave(&tx_ctx->base.lock, flags); + do { - int i; cxgb4_reclaim_completed_tx(adap, &q->q, true); - /* lock taken */ - spin_lock_irqsave(&tx_ctx->base.lock, flags); /* fetch the tls record */ record = tls_get_record(&tx_ctx->base, tcp_seq, &tx_info->record_no); @@ -2079,11 +2078,11 @@ static int chcr_ktls_xmit(struct sk_buff tls_end_offset, skb_offset, 0); - spin_unlock_irqrestore(&tx_ctx->base.lock, flags); if (ret) { /* free the refcount taken earlier */ if (tls_end_offset < data_len) dev_kfree_skb_any(skb); + spin_unlock_irqrestore(&tx_ctx->base.lock, flags); goto out; } @@ -2093,16 +2092,6 @@ static int chcr_ktls_xmit(struct sk_buff continue; } - /* increase page reference count of the record, so that there - * won't be any chance of page free in middle if in case stack - * receives ACK and try to delete the record. - */ - for (i = 0; i < record->num_frags; i++) - __skb_frag_ref(&record->frags[i]); - /* lock cleared */ - spin_unlock_irqrestore(&tx_ctx->base.lock, flags); - - /* if a tls record is finishing in this SKB */ if (tls_end_offset <= data_len) { ret = chcr_end_part_handler(tx_info, skb, record, @@ -2127,13 +2116,9 @@ static int chcr_ktls_xmit(struct sk_buff data_len = 0; } - /* clear the frag ref count which increased locally before */ - for (i = 0; i < record->num_frags; i++) { - /* clear the frag ref count */ - __skb_frag_unref(&record->frags[i]); - } /* if any failure, come out from the loop. */ if (ret) { + spin_unlock_irqrestore(&tx_ctx->base.lock, flags); if (th->fin) dev_kfree_skb_any(skb); @@ -2148,6 +2133,7 @@ static int chcr_ktls_xmit(struct sk_buff } while (data_len > 0); + spin_unlock_irqrestore(&tx_ctx->base.lock, flags); atomic64_inc(&port_stats->ktls_tx_encrypted_packets); atomic64_add(skb_data_len, &port_stats->ktls_tx_encrypted_bytes); Patches currently in stable-queue which might be from vinay.yadav@xxxxxxxxxxx are queue-5.11/ch_ktls-do-not-send-snd_una-update-to-tcb-in-middle.patch queue-5.11/ch_ktls-fix-device-connection-close.patch queue-5.11/ch_ktls-tcb-close-causes-tls-connection-failure.patch queue-5.11/ch_ktls-fix-kernel-panic.patch