diff options
| author | Ariel Ehrenberg <aehrenberg@nvidia.com> | 2026-06-15 08:16:30 +0000 |
|---|---|---|
| committer | Konstantin Belousov <kib@FreeBSD.org> | 2026-07-14 10:39:54 +0000 |
| commit | 9c7629d69cebafba3eea6787d3bfc100d60c3b19 (patch) | |
| tree | a77cce6c935e4153d476bd918573a3f6d19383e3 | |
| parent | 9c6ed9a88d3afb8bc9aba7cf852cc36e03bcd34c (diff) | |
mlx5ib: initialize DEVX subscription state before the eventfd fdget()
In the DEVX_SUBSCRIBE_EVENT handler the eventfd path can fail and
"goto err" before the subscription's xa keys and ev_file have been set;
they are still zeroed from kzalloc(). The cleanup then looks up a
level-1 xa entry with key 0, gets NULL, and faults dereferencing it.
Initialize the fields the cleanup path relies on right after the
subscription is allocated, before it is linked and before the fallible
fdget(), so a later failure unwinds cleanly.
Reviewed by: kib
Sponsored by: Nvidia networking
MFC after: 1 month
| -rw-r--r-- | sys/dev/mlx5/mlx5_ib/mlx5_ib_devx.c | 13 |
1 files changed, 6 insertions, 7 deletions
diff --git a/sys/dev/mlx5/mlx5_ib/mlx5_ib_devx.c b/sys/dev/mlx5/mlx5_ib/mlx5_ib_devx.c index 6522a0aa6daf..12ce45d8c1e7 100644 --- a/sys/dev/mlx5/mlx5_ib/mlx5_ib_devx.c +++ b/sys/dev/mlx5/mlx5_ib/mlx5_ib_devx.c @@ -2006,6 +2006,12 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)( if (!event_sub) goto err; + event_sub->cookie = cookie; + event_sub->ev_file = ev_file; + event_sub->xa_key_level1 = key_level1; + event_sub->xa_key_level2 = obj_id; + INIT_LIST_HEAD(&event_sub->obj_list); + list_add_tail(&event_sub->event_list, &sub_list); uverbs_uobject_get(&ev_file->uobj); if (use_eventfd) { @@ -2017,13 +2023,6 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)( goto err; } } - - event_sub->cookie = cookie; - event_sub->ev_file = ev_file; - /* May be needed upon cleanup the devx object/subscription */ - event_sub->xa_key_level1 = key_level1; - event_sub->xa_key_level2 = obj_id; - INIT_LIST_HEAD(&event_sub->obj_list); } /* Once all the allocations and the XA data insertions were done we |