diff options
| author | Jason Gunthorpe <jgg@mellanox.com> | 2019-02-12 21:12:56 -0700 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@mellanox.com> | 2019-02-19 20:52:18 -0700 |
| commit | ca22354b140853b8155692d5b2bc0110aa54e937 (patch) | |
| tree | 6265175dff59f674ecd82e69536f4e9a0b89f4a4 /drivers/infiniband/sw/rxe/rxe_net.c | |
| parent | 6cc2c8e535ec19153714cee62e11e4d9ac2ea953 (diff) | |
RDMA/rxe: Close a race after ib_register_device
Since rxe allows unregistration from other threads the rxe pointer can
become invalid any moment after ib_register_driver returns. This could
cause a user triggered use after free.
Add another driver callback to be called right after the device becomes
registered to complete any device setup required post-registration. This
callback has enough core locking to prevent the device from becoming
unregistered.
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to 'drivers/infiniband/sw/rxe/rxe_net.c')
| -rw-r--r-- | drivers/infiniband/sw/rxe/rxe_net.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c index d6dfbcf6a47e..fb792f5bc0b7 100644 --- a/drivers/infiniband/sw/rxe/rxe_net.c +++ b/drivers/infiniband/sw/rxe/rxe_net.c @@ -517,24 +517,24 @@ enum rdma_link_layer rxe_link_layer(struct rxe_dev *rxe, unsigned int port_num) return IB_LINK_LAYER_ETHERNET; } -struct rxe_dev *rxe_net_add(struct net_device *ndev) +int rxe_net_add(struct net_device *ndev) { int err; struct rxe_dev *rxe = NULL; rxe = ib_alloc_device(rxe_dev, ib_dev); if (!rxe) - return NULL; + return -ENOMEM; rxe->ndev = ndev; err = rxe_add(rxe, ndev->mtu); if (err) { ib_dealloc_device(&rxe->ib_dev); - return NULL; + return err; } - return rxe; + return 0; } static void rxe_port_event(struct rxe_dev *rxe, |