From nobody Tue Jul 14 10:43:16 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gzwrN3dSyz6lYPg for ; Tue, 14 Jul 2026 10:43:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gzwrN2lPFz3tB3 for ; Tue, 14 Jul 2026 10:43:16 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1784025796; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=GvbUQ8VWQQfmx69pulCcT9OjjxQbYoBFPmvtre4EnS8=; b=xTi+qoQj2AASY5YYpKCf6ICPingWY8HSfIs762cP2XY48uRG6C1S+hYu+c4TRWouBbM2Uw VAvfRYjnr9HWjlxKJ2v/hmGDVedcaOR0I9n8+dJVz5AcY44P3c7GH0bC1tAAzjBjjnPB3b ZHY/eXTrQfDpaZFUFOlgtZ+OuDZd/BIXlMnLGfM9rynjHckosCpiB3XXAFYXDAxbYMmTZX W+rG9RkyZ6SBp7fvESjo48GOPqmudthQu1MTSAySocRi56d4Aup2terkBLWUyN7geCz1UM 8Verx1bTMg8273WoH/f/5FgkpQeqKMg/p5EhDvYSpeqCaOhEqaQFE0FX+RdAEQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1784025796; a=rsa-sha256; cv=none; b=fEh1B00PCOkEGbp2WDXFebscVnDV4xGg7vQj0zpsTBS05pfFiqy01uiQASEcGVq/ALbZEy lt4UugUUN2SZZtOLSGEVrM8CqXygnMtO1J1iqIxelRH1h7FQJIIJlGLUtW8v57ux66qirI cFlNTWuGlN3xCGs/NXP2H35VNgQ58kiBl71Tf2+BI61sI4NqNbIyX485jCAHwt5NS2qVmy zdfEgkHnwJZHwyxwZjhx0KTidHhPBPEaIidUH3OItMTHm5pipMtM4SMhiMXeCJq6S0FAlc McMF++1kI5F7OD0D4V8A0QVY92lgMAtiJqHNETTWhtEbLtktVyRUwgM3ZfQEAA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1784025796; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=GvbUQ8VWQQfmx69pulCcT9OjjxQbYoBFPmvtre4EnS8=; b=nv3bNiRkIXxYENLOKRzuGzY05ANEyhyNJwAPhNnI2yG5yLEEycneiMLFkmj4Y0vkabQCx9 hnx/e2i3lwgPYnOHFpB9srD+s1qgiOJVz17smm7Xhr0+cDTwOvxzD6ysOO78AabEDYRm8e 7Sl/RIgbWxVny3GaKb+kEkaBTCaiBdWqx0eQpoi6QQRHhshmO7Dplulz40wMz5WxGVo97z JChVfqKMOkgFrGCo173aUTTtblaMmyvlmUwdum3Kaub2Ta983+7DamPtoMI7lIHZpLqGqB E5EnSYt5Ixs/A7o1hIJGTZpP6rSITkNO1QWAUV2+7pSZsnklYaZxwyKZav8B8w== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gzwrN1J8gzhgB for ; Tue, 14 Jul 2026 10:43:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1896d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 14 Jul 2026 10:43:16 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: Ariel Ehrenberg From: Konstantin Belousov Subject: git: 9c7629d69ceb - main - mlx5ib: initialize DEVX subscription state before the eventfd fdget() List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kib X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 9c7629d69cebafba3eea6787d3bfc100d60c3b19 Auto-Submitted: auto-generated Date: Tue, 14 Jul 2026 10:43:16 +0000 Message-Id: <6a5612c4.1896d.26ef1fe3@gitrepo.freebsd.org> The branch main has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=9c7629d69cebafba3eea6787d3bfc100d60c3b19 commit 9c7629d69cebafba3eea6787d3bfc100d60c3b19 Author: Ariel Ehrenberg AuthorDate: 2026-06-15 08:16:30 +0000 Commit: Konstantin Belousov CommitDate: 2026-07-14 10:39:54 +0000 mlx5ib: initialize DEVX subscription state before the eventfd fdget() In the DEVX_SUBSCRIBE_EVENT handler the eventfd path can fail and "goto err" before the subscription's xa keys and ev_file have been set; they are still zeroed from kzalloc(). The cleanup then looks up a level-1 xa entry with key 0, gets NULL, and faults dereferencing it. Initialize the fields the cleanup path relies on right after the subscription is allocated, before it is linked and before the fallible fdget(), so a later failure unwinds cleanly. Reviewed by: kib Sponsored by: Nvidia networking MFC after: 1 month --- sys/dev/mlx5/mlx5_ib/mlx5_ib_devx.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/sys/dev/mlx5/mlx5_ib/mlx5_ib_devx.c b/sys/dev/mlx5/mlx5_ib/mlx5_ib_devx.c index 6522a0aa6daf..12ce45d8c1e7 100644 --- a/sys/dev/mlx5/mlx5_ib/mlx5_ib_devx.c +++ b/sys/dev/mlx5/mlx5_ib/mlx5_ib_devx.c @@ -2006,6 +2006,12 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)( if (!event_sub) goto err; + event_sub->cookie = cookie; + event_sub->ev_file = ev_file; + event_sub->xa_key_level1 = key_level1; + event_sub->xa_key_level2 = obj_id; + INIT_LIST_HEAD(&event_sub->obj_list); + list_add_tail(&event_sub->event_list, &sub_list); uverbs_uobject_get(&ev_file->uobj); if (use_eventfd) { @@ -2017,13 +2023,6 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)( goto err; } } - - event_sub->cookie = cookie; - event_sub->ev_file = ev_file; - /* May be needed upon cleanup the devx object/subscription */ - event_sub->xa_key_level1 = key_level1; - event_sub->xa_key_level2 = obj_id; - INIT_LIST_HEAD(&event_sub->obj_list); } /* Once all the allocations and the XA data insertions were done we