Yishai Hadas 35d4a0b63d IB/uverbs: Fix race between ib_uverbs_open and remove_one ... Fixes: 2a72f21226 ("IB/uverbs: Remove dev_table") Before this commit there was a device look-up table that was protected by a spin_lock used by ib_uverbs_open and by ib_uverbs_remove_one. When it was dropped and container_of was used instead, it enabled the race with remove_one as dev might be freed just after: dev = container_of(inode->i_cdev, struct ib_uverbs_device, cdev) but before the kref_get. In addition, this buggy patch added some dead code as container_of(x,y,z) can never be NULL and so dev can never be NULL. As a result the comment above ib_uverbs_open saying "the open method will either immediately run -ENXIO" is wrong as it can never happen. The solution follows Jason Gunthorpe suggestion from below URL: https://www.mail-archive.com/linux-rdma@vger.kernel.org/msg25692.html cdev will hold a kref on the parent (the containing structure, ib_uverbs_device) and only when that kref is released it is guaranteed that open will never be called again. In addition, fixes the active count scheme to use an atomic not a kref to prevent WARN_ON as pointed by above comment from Jason. Signed-off-by: Yishai Hadas <yishaih@mellanox.com> Signed-off-by: Shachar Raindel <raindel@mellanox.com> Reviewed-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com> Signed-off-by: Doug Ledford <dledford@redhat.com>		2015-08-30 18:12:40 -04:00
..
core	IB/uverbs: Fix race between ib_uverbs_open and remove_one	2015-08-30 18:12:40 -04:00
hw	IB/mlx5: Remove ib_get_dma_mr calls	2015-08-30 18:12:34 -04:00
ulp	IB/core: Make ib_dealloc_pd return void	2015-08-30 18:12:39 -04:00
Kconfig	RDMA/amso1100: Deprecate the amso1100 driver and move to staging	2015-08-28 22:54:49 -04:00
Makefile	IB: Allow build of hw/ and ulp/ subdirectories independently	2014-06-02 14:51:12 -07:00