Please don't change that.
On command timeout we don't release ent, since the FW event on
completion can occur after timeout, so it is released on the
completion handler mlx5_cmd_comp_handler().
See commit 73dd3a4839c1d ("net/mlx5: Avoid using pending command
interface slots").
On Tue, Aug 13, 2019 at 11:22 AM Wenwen Wang <wenwen@xxxxxxxxxx> wrote:
>
> In mlx5_cmd_invoke(), 'ent' is allocated through kzalloc() in alloc_cmd().
> After the work is queued, wait_func() is invoked to wait the completion of
> the work. If wait_func() returns -ETIMEDOUT, the following execution will
> be terminated. However, the allocated 'ent' is not deallocated on this
> program path, leading to a memory leak bug.
>
> To fix the above issue, free 'ent' before returning the error.
>
> Signed-off-by: Wenwen Wang <wenwen@xxxxxxxxxx>
> ---
> drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
> index 8cdd7e6..90cdb9a 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
> @@ -1036,7 +1036,7 @@ static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in,
>
> err = wait_func(dev, ent);
> if (err == -ETIMEDOUT)
> - goto out;
> + goto out_free;
>
> ds = ent->ts2 - ent->ts1;
> op = MLX5_GET(mbox_in, in->first.data, opcode);
> --
> 2.7.4
>
