* [PATCH] net/mlx5: Reorder completion before putting command entry in cmd_work_handler
@ 2026-05-26 16:29 Nikolay Kuratov
2026-05-26 19:27 ` Haris Iqbal
2026-05-27 14:19 ` Moshe Shemesh
0 siblings, 2 replies; 3+ messages in thread
From: Nikolay Kuratov @ 2026-05-26 16:29 UTC (permalink / raw)
To: linux-kernel
Cc: netdev, linux-rdma, Saeed Mahameed, Moshe Shemesh,
Akiva Goldberger, Tariq Toukan, Nikolay Kuratov, stable
Assuming callback != NULL && !page_queue, cmd_work_handler takes
command entry with refcnt == 1 from mlx5_cmd_invoke.
If either semaphore timeout or index allocation error happens,
it does final cmd_ent_put(ent). To avoid access to freed memory,
notify slotted completion before cmd_ent_put.
This is theoretical issue found by Svace static analyser.
Cc: stable@vger.kernel.org
Fixes: 485d65e135712 ("net/mlx5: Add a timeout to acquire the command queue semaphore")
Fixes: 0e2909c6bec90 ("net/mlx5: Fix variable not being completed when function returns")
Signed-off-by: Nikolay Kuratov <kniv@yandex-team.ru>
---
drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index c89417c1a1f9..e2895972cc82 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -1002,12 +1002,13 @@ static void cmd_work_handler(struct work_struct *work)
ent->callback(-EBUSY, ent->context);
mlx5_free_cmd_msg(dev, ent->out);
free_msg(dev, ent->in);
+ complete(&ent->slotted);
cmd_ent_put(ent);
} else {
ent->ret = -EBUSY;
complete(&ent->done);
+ complete(&ent->slotted);
}
- complete(&ent->slotted);
return;
}
alloc_ret = cmd_alloc_index(cmd, ent);
@@ -1017,13 +1018,14 @@ static void cmd_work_handler(struct work_struct *work)
ent->callback(-EAGAIN, ent->context);
mlx5_free_cmd_msg(dev, ent->out);
free_msg(dev, ent->in);
+ complete(&ent->slotted);
cmd_ent_put(ent);
} else {
ent->ret = -EAGAIN;
complete(&ent->done);
+ complete(&ent->slotted);
}
up(&cmd->vars.sem);
- complete(&ent->slotted);
return;
}
} else {
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] net/mlx5: Reorder completion before putting command entry in cmd_work_handler
2026-05-26 16:29 [PATCH] net/mlx5: Reorder completion before putting command entry in cmd_work_handler Nikolay Kuratov
@ 2026-05-26 19:27 ` Haris Iqbal
2026-05-27 14:19 ` Moshe Shemesh
1 sibling, 0 replies; 3+ messages in thread
From: Haris Iqbal @ 2026-05-26 19:27 UTC (permalink / raw)
To: Nikolay Kuratov, linux-kernel
Cc: netdev, linux-rdma, Saeed Mahameed, Moshe Shemesh,
Akiva Goldberger, Tariq Toukan, stable
On 5/26/26 18:29, Nikolay Kuratov wrote:
> Assuming callback != NULL && !page_queue, cmd_work_handler takes
> command entry with refcnt == 1 from mlx5_cmd_invoke.
> If either semaphore timeout or index allocation error happens,
> it does final cmd_ent_put(ent). To avoid access to freed memory,
> notify slotted completion before cmd_ent_put.
>
> This is theoretical issue found by Svace static analyser.
>
> Cc: stable@vger.kernel.org
> Fixes: 485d65e135712 ("net/mlx5: Add a timeout to acquire the command queue semaphore")
> Fixes: 0e2909c6bec90 ("net/mlx5: Fix variable not being completed when function returns")
> Signed-off-by: Nikolay Kuratov <kniv@yandex-team.ru>
Looks good:
Reviewed-by: Md Haris Iqbal <haris.iqbal@linux.dev>
> ---
> drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
> index c89417c1a1f9..e2895972cc82 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
> @@ -1002,12 +1002,13 @@ static void cmd_work_handler(struct work_struct *work)
> ent->callback(-EBUSY, ent->context);
> mlx5_free_cmd_msg(dev, ent->out);
> free_msg(dev, ent->in);
> + complete(&ent->slotted);
> cmd_ent_put(ent);
> } else {
> ent->ret = -EBUSY;
> complete(&ent->done);
> + complete(&ent->slotted);
> }
> - complete(&ent->slotted);
> return;
> }
> alloc_ret = cmd_alloc_index(cmd, ent);
> @@ -1017,13 +1018,14 @@ static void cmd_work_handler(struct work_struct *work)
> ent->callback(-EAGAIN, ent->context);
> mlx5_free_cmd_msg(dev, ent->out);
> free_msg(dev, ent->in);
> + complete(&ent->slotted);
> cmd_ent_put(ent);
> } else {
> ent->ret = -EAGAIN;
> complete(&ent->done);
> + complete(&ent->slotted);
> }
> up(&cmd->vars.sem);
> - complete(&ent->slotted);
> return;
> }
> } else {
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] net/mlx5: Reorder completion before putting command entry in cmd_work_handler
2026-05-26 16:29 [PATCH] net/mlx5: Reorder completion before putting command entry in cmd_work_handler Nikolay Kuratov
2026-05-26 19:27 ` Haris Iqbal
@ 2026-05-27 14:19 ` Moshe Shemesh
1 sibling, 0 replies; 3+ messages in thread
From: Moshe Shemesh @ 2026-05-27 14:19 UTC (permalink / raw)
To: Nikolay Kuratov, linux-kernel
Cc: netdev, linux-rdma, Saeed Mahameed, Akiva Goldberger,
Tariq Toukan, stable
On 5/26/2026 7:29 PM, Nikolay Kuratov wrote:
> Assuming callback != NULL && !page_queue, cmd_work_handler takes
> command entry with refcnt == 1 from mlx5_cmd_invoke.
> If either semaphore timeout or index allocation error happens,
> it does final cmd_ent_put(ent). To avoid access to freed memory,
> notify slotted completion before cmd_ent_put.
>
> This is theoretical issue found by Svace static analyser.
>
> Cc:stable@vger.kernel.org
> Fixes: 485d65e135712 ("net/mlx5: Add a timeout to acquire the command queue semaphore")
> Fixes: 0e2909c6bec90 ("net/mlx5: Fix variable not being completed when function returns")
> Signed-off-by: Nikolay Kuratov<kniv@yandex-team.ru>
> ---
> drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-05-27 14:20 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-26 16:29 [PATCH] net/mlx5: Reorder completion before putting command entry in cmd_work_handler Nikolay Kuratov
2026-05-26 19:27 ` Haris Iqbal
2026-05-27 14:19 ` Moshe Shemesh
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox