diff options
| author | Moshe Shemesh <moshe@mellanox.com> | 2017-07-06 15:48:40 +0300 |
|---|---|---|
| committer | Saeed Mahameed <saeedm@mellanox.com> | 2017-07-27 16:40:16 +0300 |
| commit | 061870800efb4e3d1ad4082a2569363629bdfcfc (patch) | |
| tree | 044816c2754a14224bc09fb211550541d5d29cf5 /drivers/net/ethernet/mellanox/mlx5/core/cmd.c | |
| parent | dc798b4cc0f2a06e7ad7d522403de274b86a0a6f (diff) | |
| download | linux-0-day-061870800efb4e3d1ad4082a2569363629bdfcfc.tar.gz linux-0-day-061870800efb4e3d1ad4082a2569363629bdfcfc.tar.xz | |
net/mlx5: Fix command completion after timeout access invalid structure
Completion on timeout should not free the driver command entry structure
as it will need to access it again once real completion event from FW
will occur.
Fixes: 73dd3a4839c1 ('net/mlx5: Avoid using pending command interface slots')
Signed-off-by: Moshe Shemesh <moshe@mellanox.com>
Cc: kernel-team@fb.com
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Diffstat (limited to 'drivers/net/ethernet/mellanox/mlx5/core/cmd.c')
| -rw-r--r-- | drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c index f5a2c605749ff..25fd32fcdf794 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c @@ -967,7 +967,7 @@ static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in, err = wait_func(dev, ent); if (err == -ETIMEDOUT) - goto out_free; + goto out; ds = ent->ts2 - ent->ts1; op = MLX5_GET(mbox_in, in->first.data, opcode); @@ -1430,6 +1430,7 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool forced) mlx5_core_err(dev, "Command completion arrived after timeout (entry idx = %d).\n", ent->idx); free_ent(cmd, ent->idx); + free_cmd(ent); } continue; } @@ -1488,7 +1489,8 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool forced) free_msg(dev, ent->in); err = err ? err : ent->status; - free_cmd(ent); + if (!forced) + free_cmd(ent); callback(err, context); } else { complete(&ent->done); |