RDMA/rxe: Close a race after ib_register_device

Since rxe allows unregistration from other threads the rxe pointer can
become invalid any moment after ib_register_driver returns. This could
cause a user triggered use after free.

Add another driver callback to be called right after the device becomes
registered to complete any device setup required post-registration.  This
callback has enough core locking to prevent the device from becoming
unregistered.

Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
This commit is contained in:
Jason Gunthorpe
2019-02-12 21:12:56 -07:00
parent 6cc2c8e535
commit ca22354b14
6 changed files with 35 additions and 12 deletions

View File

@@ -2539,6 +2539,11 @@ struct ib_device_ops {
struct rdma_restrack_entry *entry);
/* Device lifecycle callbacks */
/*
* Called after the device becomes registered, before clients are
* attached
*/
int (*enable_driver)(struct ib_device *dev);
/*
* This is called as part of ib_dealloc_device().
*/