[PATCH] net/mlx5: Reorder completion before putting command entry in cmd_work_handler

[PATCH] net/mlx5: Reorder completion before putting command entry in cmd_work_handler

[Nikolay Kuratov]

Assuming callback != NULL && !page_queue, cmd_work_handler takes
command entry with refcnt == 1 from mlx5_cmd_invoke.
If either semaphore timeout or index allocation error happens,
it does final cmd_ent_put(ent). To avoid access to freed memory,
notify slotted completion before cmd_ent_put.

This is theoretical issue found by Svace static analyser.

Cc: stable@vger.kernel.org
Fixes: 485d65e135712 ("net/mlx5: Add a timeout to acquire the command queue semaphore")
Fixes: 0e2909c6bec90 ("net/mlx5: Fix variable not being completed when function returns")
Signed-off-by: Nikolay Kuratov <kniv@yandex-team.ru>
---
 drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index c89417c1a1f9..e2895972cc82 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -1002,12 +1002,13 @@ static void cmd_work_handler(struct work_struct *work)
 				ent->callback(-EBUSY, ent->context);
 				mlx5_free_cmd_msg(dev, ent->out);
 				free_msg(dev, ent->in);
+				complete(&ent->slotted);
 				cmd_ent_put(ent);
 			} else {
 				ent->ret = -EBUSY;
 				complete(&ent->done);
+				complete(&ent->slotted);
 			}
-			complete(&ent->slotted);
 			return;
 		}
 		alloc_ret = cmd_alloc_index(cmd, ent);
@@ -1017,13 +1018,14 @@ static void cmd_work_handler(struct work_struct *work)
 				ent->callback(-EAGAIN, ent->context);
 				mlx5_free_cmd_msg(dev, ent->out);
 				free_msg(dev, ent->in);
+				complete(&ent->slotted);
 				cmd_ent_put(ent);
 			} else {
 				ent->ret = -EAGAIN;
 				complete(&ent->done);
+				complete(&ent->slotted);
 			}
 			up(&cmd->vars.sem);
-			complete(&ent->slotted);
 			return;
 		}
 	} else {
-- 
2.34.1

Re: [PATCH] net/mlx5: Reorder completion before putting command entry in cmd_work_handler

[Haris Iqbal]

On 5/26/26 18:29, Nikolay Kuratov wrote:
> Assuming callback != NULL && !page_queue, cmd_work_handler takes
> command entry with refcnt == 1 from mlx5_cmd_invoke.
> If either semaphore timeout or index allocation error happens,
> it does final cmd_ent_put(ent). To avoid access to freed memory,
> notify slotted completion before cmd_ent_put.
> 
> This is theoretical issue found by Svace static analyser.
> 
> Cc: stable@vger.kernel.org
> Fixes: 485d65e135712 ("net/mlx5: Add a timeout to acquire the command queue semaphore")
> Fixes: 0e2909c6bec90 ("net/mlx5: Fix variable not being completed when function returns")
> Signed-off-by: Nikolay Kuratov <kniv@yandex-team.ru>

Looks good:

Reviewed-by: Md Haris Iqbal <haris.iqbal@linux.dev>

> ---
>   drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 ++++--
>   1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
> index c89417c1a1f9..e2895972cc82 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
> @@ -1002,12 +1002,13 @@ static void cmd_work_handler(struct work_struct *work)
>   				ent->callback(-EBUSY, ent->context);
>   				mlx5_free_cmd_msg(dev, ent->out);
>   				free_msg(dev, ent->in);
> +				complete(&ent->slotted);
>   				cmd_ent_put(ent);
>   			} else {
>   				ent->ret = -EBUSY;
>   				complete(&ent->done);
> +				complete(&ent->slotted);
>   			}
> -			complete(&ent->slotted);
>   			return;
>   		}
>   		alloc_ret = cmd_alloc_index(cmd, ent);
> @@ -1017,13 +1018,14 @@ static void cmd_work_handler(struct work_struct *work)
>   				ent->callback(-EAGAIN, ent->context);
>   				mlx5_free_cmd_msg(dev, ent->out);
>   				free_msg(dev, ent->in);
> +				complete(&ent->slotted);
>   				cmd_ent_put(ent);
>   			} else {
>   				ent->ret = -EAGAIN;
>   				complete(&ent->done);
> +				complete(&ent->slotted);
>   			}
>   			up(&cmd->vars.sem);
> -			complete(&ent->slotted);
>   			return;
>   		}
>   	} else {

Re: [PATCH] net/mlx5: Reorder completion before putting command entry in cmd_work_handler

[Moshe Shemesh]

On 5/26/2026 7:29 PM, Nikolay Kuratov wrote:
> Assuming callback != NULL && !page_queue, cmd_work_handler takes
> command entry with refcnt == 1 from mlx5_cmd_invoke.
> If either semaphore timeout or index allocation error happens,
> it does final cmd_ent_put(ent). To avoid access to freed memory,
> notify slotted completion before cmd_ent_put.
> 
> This is theoretical issue found by Svace static analyser.
> 
> Cc:stable@vger.kernel.org
> Fixes: 485d65e135712 ("net/mlx5: Add a timeout to acquire the command queue semaphore")
> Fixes: 0e2909c6bec90 ("net/mlx5: Fix variable not being completed when function returns")
> Signed-off-by: Nikolay Kuratov<kniv@yandex-team.ru>
> ---
>   drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 ++++--
>   1 file changed, 4 insertions(+), 2 deletions(-)

Reviewed-by: Moshe Shemesh <moshe@nvidia.com>

Thanks.

Re: [PATCH] net/mlx5: Reorder completion before putting command entry in cmd_work_handler

[Tariq Toukan]

On 27/05/2026 17:19, Moshe Shemesh wrote:
> 
> 
> On 5/26/2026 7:29 PM, Nikolay Kuratov wrote:
>> Assuming callback != NULL && !page_queue, cmd_work_handler takes
>> command entry with refcnt == 1 from mlx5_cmd_invoke.
>> If either semaphore timeout or index allocation error happens,
>> it does final cmd_ent_put(ent). To avoid access to freed memory,
>> notify slotted completion before cmd_ent_put.
>>
>> This is theoretical issue found by Svace static analyser.
>>
>> Cc:stable@vger.kernel.org
>> Fixes: 485d65e135712 ("net/mlx5: Add a timeout to acquire the command 
>> queue semaphore")
>> Fixes: 0e2909c6bec90 ("net/mlx5: Fix variable not being completed when 
>> function returns")
>> Signed-off-by: Nikolay Kuratov<kniv@yandex-team.ru>
>> ---
>>   drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 ++++--
>>   1 file changed, 4 insertions(+), 2 deletions(-)
> 
> Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
> 
> Thanks.
> 

Acked-by: Tariq Toukan <tariqt@nvidia.com>

Re: [PATCH] net/mlx5: Reorder completion before putting command entry in cmd_work_handler

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Tue, 26 May 2026 19:29:32 +0300 you wrote:
> Assuming callback != NULL && !page_queue, cmd_work_handler takes
> command entry with refcnt == 1 from mlx5_cmd_invoke.
> If either semaphore timeout or index allocation error happens,
> it does final cmd_ent_put(ent). To avoid access to freed memory,
> notify slotted completion before cmd_ent_put.
> 
> This is theoretical issue found by Svace static analyser.
> 
> [...]

Here is the summary with links:
  - net/mlx5: Reorder completion before putting command entry in cmd_work_handler
    https://git.kernel.org/netdev/net/c/02896a7fa4cd

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html