diff options
| author |   Jason Gunthorpe <jgg@mellanox.com> | 2019-02-12 21:12:56 -0700 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@mellanox.com> | 2019-02-19 20:52:18 -0700 |
| commit | ca22354b140853b8155692d5b2bc0110aa54e937 (patch) | |
| tree | 6265175dff59f674ecd82e69536f4e9a0b89f4a4 /drivers/infiniband/sw/rxe/rxe_sysfs.c | |
| parent | RDMA/rxe: Add ib_device_get_by_name() and use it in rxe (diff) | |
| download | linux-dev-ca22354b140853b8155692d5b2bc0110aa54e937.tar.xz linux-dev-ca22354b140853b8155692d5b2bc0110aa54e937.zip | |
RDMA/rxe: Close a race after ib_register_device
Since rxe allows unregistration from other threads the rxe pointer can
become invalid any moment after ib_register_driver returns. This could
cause a user triggered use after free.
Add another driver callback to be called right after the device becomes
registered to complete any device setup required post-registration. This
callback has enough core locking to prevent the device from becoming
unregistered.
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to 'drivers/infiniband/sw/rxe/rxe_sysfs.c')
| -rw-r--r-- | drivers/infiniband/sw/rxe/rxe_sysfs.c | 9 |
1 files changed, 2 insertions, 7 deletions
diff --git a/drivers/infiniband/sw/rxe/rxe_sysfs.c b/drivers/infiniband/sw/rxe/rxe_sysfs.c index d51b55b0a311..46587eb0da0e 100644 --- a/drivers/infiniband/sw/rxe/rxe_sysfs.c +++ b/drivers/infiniband/sw/rxe/rxe_sysfs.c @@ -60,7 +60,6 @@ static int rxe_param_set_add(const char *val, const struct kernel_param *kp) char intf[32]; struct net_device *ndev; struct rxe_dev *exists; - struct rxe_dev *rxe; len = sanitize_arg(val, intf, sizeof(intf)); if (!len) { @@ -82,16 +81,12 @@ static int rxe_param_set_add(const char *val, const struct kernel_param *kp) goto err; } - rxe = rxe_net_add(ndev); - if (!rxe) { + err = rxe_net_add(ndev); + if (err) { pr_err("failed to add %s\n", intf); - err = -EINVAL; goto err; } - rxe_set_port_state(rxe); - dev_info(&rxe->ib_dev.dev, "added %s\n", intf); - err: dev_put(ndev); return err; |