aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMoshe Shemesh <moshe@mellanox.com>2017-07-06 15:48:40 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2017-08-11 08:33:57 -0700
commitb0220535a3b683487e2ff3204cca77faabf7d23e (patch)
treea979dfa2af5bc5e1c74a8f3bbbd85fccb4f6db99
parentb79d0a855344682fb180ff570f9bc5b1ffd7e23e (diff)
downloadlinux-yocto-4.12-b0220535a3b683487e2ff3204cca77faabf7d23e.tar.gz
linux-yocto-4.12-b0220535a3b683487e2ff3204cca77faabf7d23e.tar.bz2
linux-yocto-4.12-b0220535a3b683487e2ff3204cca77faabf7d23e.zip
net/mlx5: Fix command completion after timeout access invalid structure
[ Upstream commit 061870800efb4e3d1ad4082a2569363629bdfcfc ] Completion on timeout should not free the driver command entry structure as it will need to access it again once real completion event from FW will occur. Fixes: 73dd3a4839c1 ('net/mlx5: Avoid using pending command interface slots') Signed-off-by: Moshe Shemesh <moshe@mellanox.com> Cc: kernel-team@fb.com Signed-off-by: Saeed Mahameed <saeedm@mellanox.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--drivers/net/ethernet/mellanox/mlx5/core/cmd.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 10d282841f5b..516e5d317885 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -955,7 +955,7 @@ static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in,
err = wait_func(dev, ent);
if (err == -ETIMEDOUT)
- goto out_free;
+ goto out;
ds = ent->ts2 - ent->ts1;
op = MLX5_GET(mbox_in, in->first.data, opcode);
@@ -1419,6 +1419,7 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool forced)
mlx5_core_err(dev, "Command completion arrived after timeout (entry idx = %d).\n",
ent->idx);
free_ent(cmd, ent->idx);
+ free_cmd(ent);
}
continue;
}
@@ -1477,7 +1478,8 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool forced)
free_msg(dev, ent->in);
err = err ? err : ent->status;
- free_cmd(ent);
+ if (!forced)
+ free_cmd(ent);
callback(err, context);
} else {
complete(&ent->done);