[PATCH] net/mlx5: Fix ent use-after-free in cmd_work_handler()

[Wentao Liang <vulab@iscas.ac.cn>]

In the two command slot acquisition error paths, cmd_ent_put() can drop
the last reference and free the command entry, and complete(&ent->slotted)
is then called on that freed entry.  Signal the slotted completion before
dropping the reference so that the waiter in wait_func() is woken while
the entry is still allocated and the entry is not touched after it has
been freed.

Fixes: 485d65e13571 ("net/mlx5: Add a timeout to acquire the command queue semaphore")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index c89417c1a1f9..2dac131c5f86 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -998,6 +998,7 @@ static void cmd_work_handler(struct work_struct *work)
 		if (down_timeout(&cmd->vars.sem, timeout)) {
 			mlx5_core_warn(dev, "%s(0x%x) timed out while waiting for a slot.\n",
 				       mlx5_command_str(ent->op), ent->op);
+			complete(&ent->slotted);
 			if (ent->callback) {
 				ent->callback(-EBUSY, ent->context);
 				mlx5_free_cmd_msg(dev, ent->out);
@@ -1007,12 +1008,12 @@ static void cmd_work_handler(struct work_struct *work)
 				ent->ret = -EBUSY;
 				complete(&ent->done);
 			}
-			complete(&ent->slotted);
 			return;
 		}
 		alloc_ret = cmd_alloc_index(cmd, ent);
 		if (alloc_ret < 0) {
 			mlx5_core_err_rl(dev, "failed to allocate command entry\n");
+			complete(&ent->slotted);
 			if (ent->callback) {
 				ent->callback(-EAGAIN, ent->context);
 				mlx5_free_cmd_msg(dev, ent->out);
@@ -1023,7 +1024,6 @@ static void cmd_work_handler(struct work_struct *work)
 				complete(&ent->done);
 			}
 			up(&cmd->vars.sem);
-			complete(&ent->slotted);
 			return;
 		}
 	} else {
-- 
2.34.1