diff options
| author |   Jason Gunthorpe <jgg@mellanox.com> | 2019-02-12 21:12:56 -0700 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@mellanox.com> | 2019-02-19 20:52:18 -0700 |
| commit | ca22354b140853b8155692d5b2bc0110aa54e937 (patch) | |
| tree | 6265175dff59f674ecd82e69536f4e9a0b89f4a4 /drivers/infiniband/sw/rxe/rxe_net.h | |
| parent | RDMA/rxe: Add ib_device_get_by_name() and use it in rxe (diff) | |
| download | linux-dev-ca22354b140853b8155692d5b2bc0110aa54e937.tar.xz linux-dev-ca22354b140853b8155692d5b2bc0110aa54e937.zip | |
RDMA/rxe: Close a race after ib_register_device
Since rxe allows unregistration from other threads the rxe pointer can
become invalid any moment after ib_register_driver returns. This could
cause a user triggered use after free.
Add another driver callback to be called right after the device becomes
registered to complete any device setup required post-registration. This
callback has enough core locking to prevent the device from becoming
unregistered.
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to 'drivers/infiniband/sw/rxe/rxe_net.h')
| -rw-r--r-- | drivers/infiniband/sw/rxe/rxe_net.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/infiniband/sw/rxe/rxe_net.h b/drivers/infiniband/sw/rxe/rxe_net.h index 106c586dbb26..ad79514191bb 100644 --- a/drivers/infiniband/sw/rxe/rxe_net.h +++ b/drivers/infiniband/sw/rxe/rxe_net.h @@ -43,7 +43,7 @@ struct rxe_recv_sockets { struct socket *sk6; }; -struct rxe_dev *rxe_net_add(struct net_device *ndev); +int rxe_net_add(struct net_device *ndev); int rxe_net_init(void); void rxe_net_exit(void); |