svn commit: r308680 - stable/10/sys/dev/mlx5/mlx5_core

[Hans Petter Selasky]

Author: hselasky
Date: Tue Nov 15 08:56:18 2016
New Revision: 308680
URL: https://svnweb.freebsd.org/changeset/base/308680

Log:
  MFC r308409:
  When a firmware command times out do not free the command structure to
  avoid use after free.
  
  Sponsored by:	Mellanox Technologies

Modified:
  stable/10/sys/dev/mlx5/mlx5_core/mlx5_cmd.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/dev/mlx5/mlx5_core/mlx5_cmd.c
==============================================================================
--- stable/10/sys/dev/mlx5/mlx5_core/mlx5_cmd.c	Tue Nov 15 08:54:03 2016	(r308679)
+++ stable/10/sys/dev/mlx5/mlx5_core/mlx5_cmd.c	Tue Nov 15 08:56:18 2016	(r308680)
@@ -1245,8 +1245,11 @@ static int cmd_exec_helper(struct mlx5_c
 
 	err = mlx5_cmd_invoke(dev, inb, outb, out, out_size, callback, context,
 			      pages_queue, &status);
-	if (err)
+	if (err) {
+		if (err == -ETIMEDOUT)
+			return err;
 		goto out_out;
+	}
 
 	mlx5_core_dbg(dev, "err %d, status %d\n", err, status);
 	if (status) {