xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

RDMA/rxe: Close a race after ib_register_device

Browse Source 
Since rxe allows unregistration from other threads the rxe pointer can
become invalid any moment after ib_register_driver returns. This could
cause a user triggered use after free.

Add another driver callback to be called right after the device becomes
registered to complete any device setup required post-registration.  This
callback has enough core locking to prevent the device from becoming
unregistered.

Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
This commit is contained in:
Jason Gunthorpe
2019-02-12 21:12:56 -07:00
parent 6cc2c8e535
commit ca22354b14
6 changed files with 35 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/infiniband/sw/rxe/rxe_net.c
View File

@@ -517,24 +517,24 @@ enum rdma_link_layer rxe_link_layer(struct rxe_dev *rxe, unsigned int port_num)
return IB_LINK_LAYER_ETHERNET;
}
struct rxe_dev *rxe_net_add(struct net_device *ndev)
int rxe_net_add(struct net_device *ndev)
{
int err;
struct rxe_dev *rxe = NULL;
rxe = ib_alloc_device(rxe_dev, ib_dev);
if (!rxe)
return NULL;
return -ENOMEM;
rxe->ndev = ndev;
err = rxe_add(rxe, ndev->mtu);
if (err) {
ib_dealloc_device(&rxe->ib_dev);
return NULL;
return err;
}
return rxe;
return 0;
}
static void rxe_port_event(struct rxe_dev *rxe,

2
drivers/infiniband/sw/rxe/rxe_net.h
View File

@@ -43,7 +43,7 @@ struct rxe_recv_sockets {
struct socket *sk6;
};
struct rxe_dev *rxe_net_add(struct net_device *ndev);
int rxe_net_add(struct net_device *ndev);
int rxe_net_init(void);
void rxe_net_exit(void);

9
drivers/infiniband/sw/rxe/rxe_sysfs.c
View File

@@ -60,7 +60,6 @@ static int rxe_param_set_add(const char *val, const struct kernel_param *kp)
char intf[32];
struct net_device *ndev;
struct rxe_dev *exists;
struct rxe_dev *rxe;
len = sanitize_arg(val, intf, sizeof(intf));
if (!len) {
@@ -82,16 +81,12 @@ static int rxe_param_set_add(const char *val, const struct kernel_param *kp)
goto err;
}
rxe = rxe_net_add(ndev);
if (!rxe) {
err = rxe_net_add(ndev);
if (err) {
pr_err("failed to add %s\n", intf);
err = -EINVAL;
goto err;
}
rxe_set_port_state(rxe);
dev_info(&rxe->ib_dev.dev, "added %s\n", intf);
err:
dev_put(ndev);
return err;

14
drivers/infiniband/sw/rxe/rxe_verbs.c
View File

@@ -1125,6 +1125,15 @@ static const struct attribute_group rxe_attr_group = {
.attrs = rxe_dev_attributes,
};
static int rxe_enable_driver(struct ib_device *ib_dev)
{
struct rxe_dev *rxe = container_of(ib_dev, struct rxe_dev, ib_dev);
rxe_set_port_state(rxe);
dev_info(&rxe->ib_dev.dev, "added %s\n", netdev_name(rxe->ndev));
return 0;
}
static const struct ib_device_ops rxe_dev_ops = {
.alloc_hw_stats = rxe_ib_alloc_hw_stats,
.alloc_mr = rxe_alloc_mr,
@@ -1144,6 +1153,7 @@ static const struct ib_device_ops rxe_dev_ops = {
.destroy_qp = rxe_destroy_qp,
.destroy_srq = rxe_destroy_srq,
.detach_mcast = rxe_detach_mcast,
.enable_driver = rxe_enable_driver,
.get_dma_mr = rxe_get_dma_mr,
.get_hw_stats = rxe_ib_get_hw_stats,
.get_link_layer = rxe_get_link_layer,
@@ -1245,5 +1255,9 @@ int rxe_register_device(struct rxe_dev *rxe)
if (err)
pr_warn("%s failed with error %d\n", __func__, err);
/*
* Note that rxe may be invalid at this point if another thread
* unregistered it.
*/
return err;
}