diff options
| author | Jason Gunthorpe <jgg@mellanox.com> | 2019-02-12 21:12:56 -0700 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@mellanox.com> | 2019-02-19 20:52:18 -0700 |
| commit | ca22354b140853b8155692d5b2bc0110aa54e937 (patch) | |
| tree | 6265175dff59f674ecd82e69536f4e9a0b89f4a4 /include/rdma | |
| parent | 6cc2c8e535ec19153714cee62e11e4d9ac2ea953 (diff) | |
| download | linux-ca22354b140853b8155692d5b2bc0110aa54e937.tar.bz2 | |
RDMA/rxe: Close a race after ib_register_device
Since rxe allows unregistration from other threads the rxe pointer can
become invalid any moment after ib_register_driver returns. This could
cause a user triggered use after free.
Add another driver callback to be called right after the device becomes
registered to complete any device setup required post-registration. This
callback has enough core locking to prevent the device from becoming
unregistered.
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to 'include/rdma')
| -rw-r--r-- | include/rdma/ib_verbs.h | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h index ad83f8c38dc8..640263289ab9 100644 --- a/include/rdma/ib_verbs.h +++ b/include/rdma/ib_verbs.h @@ -2540,6 +2540,11 @@ struct ib_device_ops { /* Device lifecycle callbacks */ /* + * Called after the device becomes registered, before clients are + * attached + */ + int (*enable_driver)(struct ib_device *dev); + /* * This is called as part of ib_dealloc_device(). */ void (*dealloc_driver)(struct ib_device *dev); |