crypto: caam/qi - Fix drv_ctx refcount bug

Ensure refcount is raised before request is enqueued since it could
be dequeued before the call returns.

Reported-by: Sean Anderson <sean.anderson@linux.dev>
Cc: <stable@vger.kernel.org>
Fixes: 11144416a755 ("crypto: caam/qi - optimize frame queue cleanup")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Reviewed-by: Horia Geantă <horia.geanta@nxp.com>
Tested-by: Sean Anderson <sean.anderson@linux.dev>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/drivers/crypto/caam/qi.c b/drivers/crypto/caam/qi.c
index 7701d00bcb3ac511011760033ca6b4968ec63497..b6e7c0b29d4e6c16495bcecd6869e6adf7442199 100644 (file)
--- a/drivers/crypto/caam/qi.c
+++ b/drivers/crypto/caam/qi.c
@@ -122,12 +122,12 @@ int caam_qi_enqueue(struct device *qidev, struct caam_drv_req *req)
        qm_fd_addr_set64(&fd, addr);
 
        do {
+               refcount_inc(&req->drv_ctx->refcnt);
                ret = qman_enqueue(req->drv_ctx->req_fq, &fd);
-               if (likely(!ret)) {
-                       refcount_inc(&req->drv_ctx->refcnt);
+               if (likely(!ret))
                        return 0;
-               }
 
+               refcount_dec(&req->drv_ctx->refcnt);
                if (ret != -EBUSY)
                        break;
                num_retries++;