Commit b0220535 authored by Moshe Shemesh's avatar Moshe Shemesh Committed by Greg Kroah-Hartman

net/mlx5: Fix command completion after timeout access invalid structure


[ Upstream commit 06187080 ]

Completion on timeout should not free the driver command entry structure
as it will need to access it again once real completion event from FW
will occur.

Fixes: 73dd3a48 ('net/mlx5: Avoid using pending command interface slots')
Signed-off-by: default avatarMoshe Shemesh <moshe@mellanox.com>
Cc: kernel-team@fb.com
Signed-off-by: default avatarSaeed Mahameed <saeedm@mellanox.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent b79d0a85
...@@ -955,7 +955,7 @@ static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in, ...@@ -955,7 +955,7 @@ static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in,
err = wait_func(dev, ent); err = wait_func(dev, ent);
if (err == -ETIMEDOUT) if (err == -ETIMEDOUT)
goto out_free; goto out;
ds = ent->ts2 - ent->ts1; ds = ent->ts2 - ent->ts1;
op = MLX5_GET(mbox_in, in->first.data, opcode); op = MLX5_GET(mbox_in, in->first.data, opcode);
...@@ -1419,6 +1419,7 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool forced) ...@@ -1419,6 +1419,7 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool forced)
mlx5_core_err(dev, "Command completion arrived after timeout (entry idx = %d).\n", mlx5_core_err(dev, "Command completion arrived after timeout (entry idx = %d).\n",
ent->idx); ent->idx);
free_ent(cmd, ent->idx); free_ent(cmd, ent->idx);
free_cmd(ent);
} }
continue; continue;
} }
...@@ -1477,7 +1478,8 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool forced) ...@@ -1477,7 +1478,8 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool forced)
free_msg(dev, ent->in); free_msg(dev, ent->in);
err = err ? err : ent->status; err = err ? err : ent->status;
free_cmd(ent); if (!forced)
free_cmd(ent);
callback(err, context); callback(err, context);
} else { } else {
complete(&ent->done); complete(&ent->done);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment