[PATCH] net/mlx5: Fix ent use-after-free in cmd_work_handler()
From: Wentao Liang <hidden>
Date: 2026-09-17 11:29:10
Also in:
linux-rdma, lkml, stable
Subsystem:
mellanox mlx5 core vpi driver, networking drivers, the rest · Maintainers:
Saeed Mahameed, Leon Romanovsky, Tariq Toukan, Mark Bloch, Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
In the two command slot acquisition error paths, cmd_ent_put() can drop
the last reference and free the command entry, and complete(&ent->slotted)
is then called on that freed entry. Signal the slotted completion before
dropping the reference so that the waiter in wait_func() is woken while
the entry is still allocated and the entry is not touched after it has
been freed.
Fixes: 485d65e13571 ("net/mlx5: Add a timeout to acquire the command queue semaphore")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <redacted>
---
drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index c89417c1a1f9..2dac131c5f86 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c@@ -998,6 +998,7 @@ static void cmd_work_handler(struct work_struct *work) if (down_timeout(&cmd->vars.sem, timeout)) { mlx5_core_warn(dev, "%s(0x%x) timed out while waiting for a slot.\n", mlx5_command_str(ent->op), ent->op); + complete(&ent->slotted); if (ent->callback) { ent->callback(-EBUSY, ent->context); mlx5_free_cmd_msg(dev, ent->out);
@@ -1007,12 +1008,12 @@ static void cmd_work_handler(struct work_struct *work) ent->ret = -EBUSY; complete(&ent->done); } - complete(&ent->slotted); return; } alloc_ret = cmd_alloc_index(cmd, ent); if (alloc_ret < 0) { mlx5_core_err_rl(dev, "failed to allocate command entry\n"); + complete(&ent->slotted); if (ent->callback) { ent->callback(-EAGAIN, ent->context); mlx5_free_cmd_msg(dev, ent->out);
@@ -1023,7 +1024,6 @@ static void cmd_work_handler(struct work_struct *work) complete(&ent->done); } up(&cmd->vars.sem); - complete(&ent->slotted); return; } } else {
--
2.34.1