git: 9c7629d69ceb - main - mlx5ib: initialize DEVX subscription state before the eventfd fdget()

The branch main has been updated by kib:

URL: https://cgit.FreeBSD.org/src/commit/?id=9c7629d69cebafba3eea6787d3bfc100d60c3b19

commit 9c7629d69cebafba3eea6787d3bfc100d60c3b19
Author:     Ariel Ehrenberg <aehrenberg@nvidia.com>
AuthorDate: 2026-06-15 08:16:30 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2026-07-14 10:39:54 +0000

    mlx5ib: initialize DEVX subscription state before the eventfd fdget()
    
    In the DEVX_SUBSCRIBE_EVENT handler the eventfd path can fail and
    "goto err" before the subscription's xa keys and ev_file have been set;
    they are still zeroed from kzalloc().  The cleanup then looks up a
    level-1 xa entry with key 0, gets NULL, and faults dereferencing it.
    
    Initialize the fields the cleanup path relies on right after the
    subscription is allocated, before it is linked and before the fallible
    fdget(), so a later failure unwinds cleanly.
    
    Reviewed by: kib
    Sponsored by: Nvidia networking
    MFC after: 1 month
---
 sys/dev/mlx5/mlx5_ib/mlx5_ib_devx.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/sys/dev/mlx5/mlx5_ib/mlx5_ib_devx.c b/sys/dev/mlx5/mlx5_ib/mlx5_ib_devx.c
index 6522a0aa6daf..12ce45d8c1e7 100644
--- a/sys/dev/mlx5/mlx5_ib/mlx5_ib_devx.c
+++ b/sys/dev/mlx5/mlx5_ib/mlx5_ib_devx.c
@@ -2006,6 +2006,12 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)(
 		if (!event_sub)
 			goto err;
 
+		event_sub->cookie = cookie;
+		event_sub->ev_file = ev_file;
+		event_sub->xa_key_level1 = key_level1;
+		event_sub->xa_key_level2 = obj_id;
+		INIT_LIST_HEAD(&event_sub->obj_list);
+
 		list_add_tail(&event_sub->event_list, &sub_list);
 		uverbs_uobject_get(&ev_file->uobj);
 		if (use_eventfd) {
@@ -2017,13 +2023,6 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)(
 				goto err;
 			}
 		}
-
-		event_sub->cookie = cookie;
-		event_sub->ev_file = ev_file;
-		/* May be needed upon cleanup the devx object/subscription */
-		event_sub->xa_key_level1 = key_level1;
-		event_sub->xa_key_level2 = obj_id;
-		INIT_LIST_HEAD(&event_sub->obj_list);
 	}
 
 	/* Once all the allocations and the XA data insertions were done we