git: e0cea2ad6463 - stable/15 - if_bnxt: ktls: Reject new kTLS sessions once driver is detaching

The branch stable/15 has been updated by kbowling:

URL: https://cgit.FreeBSD.org/src/commit/?id=e0cea2ad6463f44d5e0e40d6187d5efb3f63ba6a

commit e0cea2ad6463f44d5e0e40d6187d5efb3f63ba6a
Author:     Sumit Saxena <sumit.saxena@broadcom.com>
AuthorDate: 2026-07-31 15:53:02 +0000
Commit:     Kevin Bowling <kbowling@FreeBSD.org>
CommitDate: 2026-10-29 23:25:51 +0000

    if_bnxt: ktls: Reject new kTLS sessions once driver is detaching
    
    bnxt_tls_snd_tag_alloc() only gated on BNXT_STATE_OPEN, which is set
    once by bnxt_open()/bnxt_attach_pre() but never cleared again, so it
    could not reject new sessions once bnxt_detach() started tearing
    things down. The snd_tag_alloc_ref-based wait in bnxt_detach(), which
    waits for in-flight allocators to exit, was already in place, but
    without this gate new sessions could keep being created for the
    entire duration of that wait, extending it indefinitely instead of
    just draining existing ones.
    
    Reject new sessions once softc->detached is set, and reset it back to
    false in bnxt_attach_pre() so it doesn't wrongly persist across a
    detach/reattach cycle.
    
    Reviewed by:    gallatin
    Sponsored by:   Broadcom Inc.
    Differential Revision:  https://reviews.freebsd.org/D58612
    
    (cherry picked from commit a48a50919da5549b2a5a2141042087a25879435e)
---
 sys/dev/bnxt/bnxt_en/bnxt_ktls.c | 12 ++++++++++++
 sys/dev/bnxt/bnxt_en/if_bnxt.c   |  1 +
 2 files changed, 13 insertions(+)

diff --git a/sys/dev/bnxt/bnxt_en/bnxt_ktls.c b/sys/dev/bnxt/bnxt_en/bnxt_ktls.c
index 0578de559910..90c59607f336 100644
--- a/sys/dev/bnxt/bnxt_en/bnxt_ktls.c
+++ b/sys/dev/bnxt/bnxt_en/bnxt_ktls.c
@@ -180,8 +180,20 @@ int bnxt_tls_snd_tag_alloc(if_t ifp, union if_snd_tag_alloc_params* params,
 	if (!test_bit(BNXT_STATE_OPEN, &priv->state))
 		return (EPROTONOSUPPORT);
 
+	if (atomic_load_acq_int(&priv->detached))
+		return (EPROTONOSUPPORT);
+
+	/*
+	 * Re-check `detached` after incrementing snd_tag_alloc_ref so
+	 * bnxt_detach()'s drain loop can see this ref and wait for it.
+	 */
 	atomic_add_32(&priv->ktls_info->snd_tag_alloc_ref, 1);
 
+	if (atomic_load_acq_int(&priv->detached)) {
+		atomic_subtract_32(&priv->ktls_info->snd_tag_alloc_ref, 1);
+		return (EPROTONOSUPPORT);
+	}
+
 	if (priv->ktls_info->init == 0) {
 		counter_u64_add(ktls->err_counters[BNXT_KTLS_TX_UNINITIALIZED], 1);
 		atomic_subtract_32(&priv->ktls_info->snd_tag_alloc_ref, 1);
diff --git a/sys/dev/bnxt/bnxt_en/if_bnxt.c b/sys/dev/bnxt/bnxt_en/if_bnxt.c
index 56c562ea1b7f..61cbae29ecd2 100644
--- a/sys/dev/bnxt/bnxt_en/if_bnxt.c
+++ b/sys/dev/bnxt/bnxt_en/if_bnxt.c
@@ -2682,6 +2682,7 @@ bnxt_attach_pre(if_ctx_t ctx)
 	softc->slot = pci_get_slot(softc->dev);
 	softc->function = pci_get_function(softc->dev);
 	softc->dev_fn = PCI_DEVFN(softc->slot, softc->function);
+	atomic_store_rel_int(&softc->detached, 0);
 
 	bnxt_set_flags_by_devid(softc);