The branch main has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=9c7629d69cebafba3eea6787d3bfc100d60c3b19
commit 9c7629d69cebafba3eea6787d3bfc100d60c3b19 Author: Ariel Ehrenberg <[email protected]> AuthorDate: 2026-06-15 08:16:30 +0000 Commit: Konstantin Belousov <[email protected]> CommitDate: 2026-07-14 10:39:54 +0000 mlx5ib: initialize DEVX subscription state before the eventfd fdget() In the DEVX_SUBSCRIBE_EVENT handler the eventfd path can fail and "goto err" before the subscription's xa keys and ev_file have been set; they are still zeroed from kzalloc(). The cleanup then looks up a level-1 xa entry with key 0, gets NULL, and faults dereferencing it. Initialize the fields the cleanup path relies on right after the subscription is allocated, before it is linked and before the fallible fdget(), so a later failure unwinds cleanly. Reviewed by: kib Sponsored by: Nvidia networking MFC after: 1 month --- sys/dev/mlx5/mlx5_ib/mlx5_ib_devx.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/sys/dev/mlx5/mlx5_ib/mlx5_ib_devx.c b/sys/dev/mlx5/mlx5_ib/mlx5_ib_devx.c index 6522a0aa6daf..12ce45d8c1e7 100644 --- a/sys/dev/mlx5/mlx5_ib/mlx5_ib_devx.c +++ b/sys/dev/mlx5/mlx5_ib/mlx5_ib_devx.c @@ -2006,6 +2006,12 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)( if (!event_sub) goto err; + event_sub->cookie = cookie; + event_sub->ev_file = ev_file; + event_sub->xa_key_level1 = key_level1; + event_sub->xa_key_level2 = obj_id; + INIT_LIST_HEAD(&event_sub->obj_list); + list_add_tail(&event_sub->event_list, &sub_list); uverbs_uobject_get(&ev_file->uobj); if (use_eventfd) { @@ -2017,13 +2023,6 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)( goto err; } } - - event_sub->cookie = cookie; - event_sub->ev_file = ev_file; - /* May be needed upon cleanup the devx object/subscription */ - event_sub->xa_key_level1 = key_level1; - event_sub->xa_key_level2 = obj_id; - INIT_LIST_HEAD(&event_sub->obj_list); } /* Once all the allocations and the XA data insertions were done we
