From 97ac39086142ed8cacf7e5b67a2c4b71549f9ce1 Mon Sep 17 00:00:00 2001
From: Hans Petter Selasky <hselasky@FreeBSD.org>
Date: Mon, 7 Nov 2016 11:15:40 +0000
Subject: [PATCH] When a firmware command times out do not free the command
 structure to avoid use after free.

Sponsored by:	Mellanox Technologies
MFC after:	1 week
---
 sys/dev/mlx5/mlx5_core/mlx5_cmd.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sys/dev/mlx5/mlx5_core/mlx5_cmd.c b/sys/dev/mlx5/mlx5_core/mlx5_cmd.c
index 2551d3e8312f..6d6e036e86bf 100644
--- a/sys/dev/mlx5/mlx5_core/mlx5_cmd.c
+++ b/sys/dev/mlx5/mlx5_core/mlx5_cmd.c
@@ -1245,8 +1245,11 @@ static int cmd_exec_helper(struct mlx5_core_dev *dev, void *in, int in_size, voi
 
 	err = mlx5_cmd_invoke(dev, inb, outb, out, out_size, callback, context,
 			      pages_queue, &status);
-	if (err)
+	if (err) {
+		if (err == -ETIMEDOUT)
+			return err;
 		goto out_out;
+	}
 
 	mlx5_core_dbg(dev, "err %d, status %d\n", err, status);
 	if (status) {