[PATCH] net/mlx5: Fix ent use-after-free in cmd_work_handler()

[PATCH] net/mlx5: Fix ent use-after-free in cmd_work_handler()

[Wentao Liang]

In the two command slot acquisition error paths, cmd_ent_put() can drop
the last reference and free the command entry, and complete(&ent->slotted)
is then called on that freed entry.  Signal the slotted completion before
dropping the reference so that the waiter in wait_func() is woken while
the entry is still allocated and the entry is not touched after it has
been freed.

Fixes: 485d65e13571 ("net/mlx5: Add a timeout to acquire the command queue semaphore")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index c89417c1a1f9..2dac131c5f86 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -998,6 +998,7 @@ static void cmd_work_handler(struct work_struct *work)
 		if (down_timeout(&cmd->vars.sem, timeout)) {
 			mlx5_core_warn(dev, "%s(0x%x) timed out while waiting for a slot.\n",
 				       mlx5_command_str(ent->op), ent->op);
+			complete(&ent->slotted);
 			if (ent->callback) {
 				ent->callback(-EBUSY, ent->context);
 				mlx5_free_cmd_msg(dev, ent->out);
@@ -1007,12 +1008,12 @@ static void cmd_work_handler(struct work_struct *work)
 				ent->ret = -EBUSY;
 				complete(&ent->done);
 			}
-			complete(&ent->slotted);
 			return;
 		}
 		alloc_ret = cmd_alloc_index(cmd, ent);
 		if (alloc_ret < 0) {
 			mlx5_core_err_rl(dev, "failed to allocate command entry\n");
+			complete(&ent->slotted);
 			if (ent->callback) {
 				ent->callback(-EAGAIN, ent->context);
 				mlx5_free_cmd_msg(dev, ent->out);
@@ -1023,7 +1024,6 @@ static void cmd_work_handler(struct work_struct *work)
 				complete(&ent->done);
 			}
 			up(&cmd->vars.sem);
-			complete(&ent->slotted);
 			return;
 		}
 	} else {
-- 
2.34.1

Re: [PATCH] net/mlx5: Fix ent use-after-free in cmd_work_handler()

[Moshe Shemesh]

On 9/17/2026 2:29 PM, Wentao Liang wrote:
> 
> In the two command slot acquisition error paths, cmd_ent_put() can drop
> the last reference and free the command entry, and complete(&ent->slotted)
> is then called on that freed entry.  Signal the slotted completion before
> dropping the reference so that the waiter in wait_func() is woken while
> the entry is still allocated and the entry is not touched after it has
> been freed.


This is already fixed upstream by
commit 02896a7fa4cd ("net/mlx5: Reorder completion before putting 
command entry in cmd_work_handler").

Thanks, Moshe.

> 
> Fixes: 485d65e13571 ("net/mlx5: Add a timeout to acquire the command queue semaphore")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>   drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
> index c89417c1a1f9..2dac131c5f86 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
> @@ -998,6 +998,7 @@ static void cmd_work_handler(struct work_struct *work)
>                  if (down_timeout(&cmd->vars.sem, timeout)) {
>                          mlx5_core_warn(dev, "%s(0x%x) timed out while waiting for a slot.\n",
>                                         mlx5_command_str(ent->op), ent->op);
> +                       complete(&ent->slotted);
>                          if (ent->callback) {
>                                  ent->callback(-EBUSY, ent->context);
>                                  mlx5_free_cmd_msg(dev, ent->out);
> @@ -1007,12 +1008,12 @@ static void cmd_work_handler(struct work_struct *work)
>                                  ent->ret = -EBUSY;
>                                  complete(&ent->done);
>                          }
> -                       complete(&ent->slotted);
>                          return;
>                  }
>                  alloc_ret = cmd_alloc_index(cmd, ent);
>                  if (alloc_ret < 0) {
>                          mlx5_core_err_rl(dev, "failed to allocate command entry\n");
> +                       complete(&ent->slotted);
>                          if (ent->callback) {
>                                  ent->callback(-EAGAIN, ent->context);
>                                  mlx5_free_cmd_msg(dev, ent->out);
> @@ -1023,7 +1024,6 @@ static void cmd_work_handler(struct work_struct *work)
>                                  complete(&ent->done);
>                          }
>                          up(&cmd->vars.sem);
> -                       complete(&ent->slotted);
>                          return;
>                  }
>          } else {
> --
> 2.34.1
>