aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorHans Petter Selasky <hselasky@FreeBSD.org>2022-06-21 09:07:06 +0000
committerHans Petter Selasky <hselasky@FreeBSD.org>2022-06-21 09:33:27 +0000
commit55d183367104e3efcdaa936f65e4f82303871271 (patch)
tree4accab82acef69e8e62c71e16f168a094edb6512
parentf2deb5e40c92e0747a0e29c2869cef8a6863be0e (diff)
downloadsrc-55d183367104e3efcdaa936f65e4f82303871271.tar.gz
src-55d183367104e3efcdaa936f65e4f82303871271.zip
ibcore: Fix sysfs registration error flow
The kernel commit cited below restructured ib device management so that the device kobject is initialized in ib_alloc_device. As part of the restructuring, the kobject is now initialized in procedure ib_alloc_device, and is later added to the device hierarchy in the ib_register_device call stack, in procedure ib_device_register_sysfs (which calls device_add). However, in the ib_device_register_sysfs error flow, if an error occurs following the call to device_add, the cleanup procedure device_unregister is called. This call results in the device object being deleted -- which results in various use-after-free crashes. The correct cleanup call is device_del -- which undoes device_add without deleting the device object. The device object will then (correctly) be deleted in the ib_register_device caller's error cleanup flow, when the caller invokes ib_dealloc_device. Linux commit: b312be3d87e4c80872cbea869e569175c5eb0f9a PR: 264472 MFC after: 3 days Sponsored by: NVIDIA Networking
-rw-r--r--sys/ofed/drivers/infiniband/core/ib_sysfs.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/ofed/drivers/infiniband/core/ib_sysfs.c b/sys/ofed/drivers/infiniband/core/ib_sysfs.c
index 4cbb69ad899b..63f6c2641b83 100644
--- a/sys/ofed/drivers/infiniband/core/ib_sysfs.c
+++ b/sys/ofed/drivers/infiniband/core/ib_sysfs.c
@@ -1366,7 +1366,7 @@ err_put:
free_port_list_attributes(device);
err_unregister:
- device_unregister(class_dev);
+ device_del(class_dev);
err:
return ret;