diff options
| author | Hans Petter Selasky <hselasky@FreeBSD.org> | 2018-03-30 19:50:45 +0000 |
|---|---|---|
| committer | Hans Petter Selasky <hselasky@FreeBSD.org> | 2018-03-30 19:50:45 +0000 |
| commit | 4d5fdbe9b880e0aaf8561a377ca9958a582a5d8e (patch) | |
| tree | 53f67a9b6cbfc7e0d51505856d71ebcbbfcc7a61 | |
| parent | ca2345a05d53e19063a53304c5e9a7d20bc87176 (diff) | |
| download | src-4d5fdbe9b880e0aaf8561a377ca9958a582a5d8e.tar.gz src-4d5fdbe9b880e0aaf8561a377ca9958a582a5d8e.zip | |
Fix for use after free in mlx5core.
Make sure the command completion handler is not called when the device is
in internal error state. This can easily trigger use after free situations.
MFC after: 3 days
Sponsored by: Mellanox Technologies
Notes
Notes:
svn path=/head/; revision=331825
| -rw-r--r-- | sys/dev/mlx5/mlx5_core/mlx5_eq.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sys/dev/mlx5/mlx5_core/mlx5_eq.c b/sys/dev/mlx5/mlx5_core/mlx5_eq.c index fae5ce65de0b..c972d27e8dd5 100644 --- a/sys/dev/mlx5/mlx5_core/mlx5_eq.c +++ b/sys/dev/mlx5/mlx5_core/mlx5_eq.c @@ -254,7 +254,8 @@ static int mlx5_eq_int(struct mlx5_core_dev *dev, struct mlx5_eq *eq) break; case MLX5_EVENT_TYPE_CMD: - mlx5_cmd_comp_handler(dev, be32_to_cpu(eqe->data.cmd.vector)); + if (dev->state != MLX5_DEVICE_STATE_INTERNAL_ERROR) + mlx5_cmd_comp_handler(dev, be32_to_cpu(eqe->data.cmd.vector)); break; case MLX5_EVENT_TYPE_PORT_CHANGE: |