xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

RDMA/rxe: Close a race after ib_register_device

Browse Source 
Since rxe allows unregistration from other threads the rxe pointer can
become invalid any moment after ib_register_driver returns. This could
cause a user triggered use after free.

Add another driver callback to be called right after the device becomes
registered to complete any device setup required post-registration.  This
callback has enough core locking to prevent the device from becoming
unregistered.

Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
This commit is contained in:
Jason Gunthorpe
2019-02-12 21:12:56 -07:00
parent 6cc2c8e535
commit ca22354b14
6 changed files with 35 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/infiniband/sw/rxe/rxe_net.c
View File

@@ -517,24 +517,24 @@ enum rdma_link_layer rxe_link_layer(struct rxe_dev *rxe, unsigned int port_num)
return IB_LINK_LAYER_ETHERNET;
}
struct rxe_dev *rxe_net_add(struct net_device *ndev)
int rxe_net_add(struct net_device *ndev)
{
int err;
struct rxe_dev *rxe = NULL;
rxe = ib_alloc_device(rxe_dev, ib_dev);
if (!rxe)
return NULL;
return -ENOMEM;
rxe->ndev = ndev;
err = rxe_add(rxe, ndev->mtu);
if (err) {
ib_dealloc_device(&rxe->ib_dev);
return NULL;
return err;
}
return rxe;
return 0;
}
static void rxe_port_event(struct rxe_dev *rxe,