RDMA/rxe: Close a race after ib_register_device
authorJason Gunthorpe <jgg@mellanox.com>
Wed, 13 Feb 2019 04:12:56 +0000 (21:12 -0700)
committerJason Gunthorpe <jgg@mellanox.com>
Wed, 20 Feb 2019 03:52:18 +0000 (20:52 -0700)
commitca22354b140853b8155692d5b2bc0110aa54e937
tree6265175dff59f674ecd82e69536f4e9a0b89f4a4
parent6cc2c8e535ec19153714cee62e11e4d9ac2ea953
RDMA/rxe: Close a race after ib_register_device

Since rxe allows unregistration from other threads the rxe pointer can
become invalid any moment after ib_register_driver returns. This could
cause a user triggered use after free.

Add another driver callback to be called right after the device becomes
registered to complete any device setup required post-registration.  This
callback has enough core locking to prevent the device from becoming
unregistered.

Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
drivers/infiniband/core/device.c
drivers/infiniband/sw/rxe/rxe_net.c
drivers/infiniband/sw/rxe/rxe_net.h
drivers/infiniband/sw/rxe/rxe_sysfs.c
drivers/infiniband/sw/rxe/rxe_verbs.c
include/rdma/ib_verbs.h