]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
net/mlx5: Reorder completion before putting command entry in cmd_work_handler
authorNikolay Kuratov <kniv@yandex-team.ru>
Tue, 26 May 2026 16:29:32 +0000 (19:29 +0300)
committerPaolo Abeni <pabeni@redhat.com>
Mon, 1 Jun 2026 11:58:02 +0000 (13:58 +0200)
commit02896a7fa4cd3ec61d60ba30136841e4f04bdeac
treeed04a0f99c08cce9c5f217bd4045ed60fbcb8bc4
parentf3be0c984ecbcb82b0bec408022c4ef738cb3843
net/mlx5: Reorder completion before putting command entry in cmd_work_handler

Assuming callback != NULL && !page_queue, cmd_work_handler takes
command entry with refcnt == 1 from mlx5_cmd_invoke.
If either semaphore timeout or index allocation error happens,
it does final cmd_ent_put(ent). To avoid access to freed memory,
notify slotted completion before cmd_ent_put.

This is theoretical issue found by Svace static analyser.

Cc: stable@vger.kernel.org
Fixes: 485d65e135712 ("net/mlx5: Add a timeout to acquire the command queue semaphore")
Fixes: 0e2909c6bec90 ("net/mlx5: Fix variable not being completed when function returns")
Signed-off-by: Nikolay Kuratov <kniv@yandex-team.ru>
Reviewed-by: Md Haris Iqbal <haris.iqbal@linux.dev>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Acked-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20260526162932.501584-1-kniv@yandex-team.ru
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
drivers/net/ethernet/mellanox/mlx5/core/cmd.c