svn commit: r308409 - head/sys/dev/mlx5/mlx5_core

[Hans Petter Selasky]

Author: hselasky
Date: Mon Nov  7 11:15:40 2016
New Revision: 308409
URL: https://svnweb.freebsd.org/changeset/base/308409

Log:
  When a firmware command times out do not free the command structure to
  avoid use after free.
  
  Sponsored by:	Mellanox Technologies
  MFC after:	1 week

Modified:
  head/sys/dev/mlx5/mlx5_core/mlx5_cmd.c

Modified: head/sys/dev/mlx5/mlx5_core/mlx5_cmd.c
==============================================================================
--- head/sys/dev/mlx5/mlx5_core/mlx5_cmd.c	Mon Nov  7 11:01:09 2016	(r308408)
+++ head/sys/dev/mlx5/mlx5_core/mlx5_cmd.c	Mon Nov  7 11:15:40 2016	(r308409)
@@ -1245,8 +1245,11 @@ static int cmd_exec_helper(struct mlx5_c
 
 	err = mlx5_cmd_invoke(dev, inb, outb, out, out_size, callback, context,
 			      pages_queue, &status);
-	if (err)
+	if (err) {
+		if (err == -ETIMEDOUT)
+			return err;
 		goto out_out;
+	}
 
 	mlx5_core_dbg(dev, "err %d, status %d\n", err, status);
 	if (status) {