Re: [PATCH net v2] net/mlx5: Don't return firmware-owned command mailboxes to the DMA pool

[sashiko-bot@kernel.org]

> On a command timeout mlx5_cmd_comp_handler(forced) keeps the entry and its
> queue slot, because firmware may still complete the command and write to
> ent->lay. cmd_exec() and the callback path free the mailboxes anyway,
> while ent->lay->{in_ptr,out_ptr} still point at them.
> 
> dma_pool keeps its free list node in the first 16 bytes of the block,
> which for mlx5 is the start of the command payload, so a late firmware
> write corrupts the allocator:
> 
>   Unable to handle kernel paging request at virtual address
>   0007c830040001a0
>   pc : dma_pool_alloc+0x48/0x430   lr : mlx5_alloc_cmd_msg+0x154/0x318
>   Call trace:
>    dma_pool_alloc+0x48/0x430 (P)
>    mlx5_alloc_cmd_msg+0x154/0x318
> [ ... ]
> allocator.
> 
> Fixes: 73dd3a4839c1 ("net/mlx5: Avoid using pending command interface slots")
> Cc: stable@vger.kernel.org
> Signed-off-by: Danielle Costantino <dcostantino@meta.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260923190542.848049-1-dcostantino@meta.com?part=1