IB: Remove sysfs files before unregistering device

Move the ib_device_unregister_sysfs() call from ib_dealloc_device() to
ib_unregister_device().  The old code allows device unregister to
proceed even if some sysfs files are open, which leaves a window where
userspace can open a file before a device is removed but then end up
reading the file after the device is removed, which leads to various
kernel crashes either because the device data structure is freed or
because the low-level driver code is gone after module removal.

By not returning from ib_unregister_device() until after all sysfs
entries are removed, we make sure that data structures and/or module
code is not freed until after all sysfs access is done.

Reported-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 7913b804311ebc3809522f99246e01bc84b723f4..d1fba4153332658d4ab922f4d744cd1a1449c06b 100644 (file)
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -193,7 +193,7 @@ void ib_dealloc_device(struct ib_device *device)
 
        BUG_ON(device->reg_state != IB_DEV_UNREGISTERED);
 
-       ib_device_unregister_sysfs(device);
+       kobject_put(&device->dev.kobj);
 }
 EXPORT_SYMBOL(ib_dealloc_device);
 
@@ -348,6 +348,8 @@ void ib_unregister_device(struct ib_device *device)
 
        mutex_unlock(&device_mutex);
 
+       ib_device_unregister_sysfs(device);
+
        spin_lock_irqsave(&device->client_data_lock, flags);
        list_for_each_entry_safe(context, tmp, &device->client_data_list, list)
                kfree(context);

diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index b43f7d3682d387eb4de8bf3581a9499660cd97db..5270aeb56e9eb47d243bca8e201a6ad81d95229d 100644 (file)
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -848,6 +848,9 @@ void ib_device_unregister_sysfs(struct ib_device *device)
        struct kobject *p, *t;
        struct ib_port *port;
 
+       /* Hold kobject until ib_dealloc_device() */
+       kobject_get(&device->dev.kobj);
+
        list_for_each_entry_safe(p, t, &device->port_list, entry) {
                list_del(&p->entry);
                port = container_of(p, struct ib_port, kobj);