Date: Mon, 7 Nov 2016 11:15:40 +0000 (UTC) From: Hans Petter Selasky <hselasky@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r308409 - head/sys/dev/mlx5/mlx5_core Message-ID: <201611071115.uA7BFe9O095036@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: hselasky Date: Mon Nov 7 11:15:40 2016 New Revision: 308409 URL: https://svnweb.freebsd.org/changeset/base/308409 Log: When a firmware command times out do not free the command structure to avoid use after free. Sponsored by: Mellanox Technologies MFC after: 1 week Modified: head/sys/dev/mlx5/mlx5_core/mlx5_cmd.c Modified: head/sys/dev/mlx5/mlx5_core/mlx5_cmd.c ============================================================================== --- head/sys/dev/mlx5/mlx5_core/mlx5_cmd.c Mon Nov 7 11:01:09 2016 (r308408) +++ head/sys/dev/mlx5/mlx5_core/mlx5_cmd.c Mon Nov 7 11:15:40 2016 (r308409) @@ -1245,8 +1245,11 @@ static int cmd_exec_helper(struct mlx5_c err = mlx5_cmd_invoke(dev, inb, outb, out, out_size, callback, context, pages_queue, &status); - if (err) + if (err) { + if (err == -ETIMEDOUT) + return err; goto out_out; + } mlx5_core_dbg(dev, "err %d, status %d\n", err, status); if (status) {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201611071115.uA7BFe9O095036>