IB/umad: Fix use-after-free on close

[cascardo/linux.git] / drivers / infiniband / core / user_mad.c

diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
index 9bdf576..1acb991 100644 (file)
--- a/drivers/infiniband/core/user_mad.c
+++ b/drivers/infiniband/core/user_mad.c
@@ -98,7 +98,7 @@ struct ib_umad_port {
 
 struct ib_umad_device {
        int                  start_port, end_port;
-       struct kref          ref;
+       struct kobject       kobj;
        struct ib_umad_port  port[0];
 };
 
@@ -134,14 +134,18 @@ static DECLARE_BITMAP(dev_map, IB_UMAD_MAX_PORTS);
 static void ib_umad_add_one(struct ib_device *device);
 static void ib_umad_remove_one(struct ib_device *device);
 
-static void ib_umad_release_dev(struct kref *ref)
+static void ib_umad_release_dev(struct kobject *kobj)
 {
        struct ib_umad_device *dev =
-               container_of(ref, struct ib_umad_device, ref);
+               container_of(kobj, struct ib_umad_device, kobj);
 
        kfree(dev);
 }
 
+static struct kobj_type ib_umad_dev_ktype = {
+       .release = ib_umad_release_dev,
+};
+
 static int hdr_size(struct ib_umad_file *file)
 {
        return file->use_pkey_index ? sizeof (struct ib_user_mad_hdr) :
@@ -812,7 +816,7 @@ static int ib_umad_open(struct inode *inode, struct file *filp)
                goto out;
        }
 
-       kref_get(&port->umad_dev->ref);
+       kobject_get(&port->umad_dev->kobj);
 
 out:
        mutex_unlock(&port->file_mutex);
@@ -851,7 +855,7 @@ static int ib_umad_close(struct inode *inode, struct file *filp)
        mutex_unlock(&file->port->file_mutex);
 
        kfree(file);
-       kref_put(&dev->ref, ib_umad_release_dev);
+       kobject_put(&dev->kobj);
 
        return 0;
 }
@@ -902,7 +906,7 @@ static int ib_umad_sm_open(struct inode *inode, struct file *filp)
        if (ret)
                goto err_clr_sm_cap;
 
-       kref_get(&port->umad_dev->ref);
+       kobject_get(&port->umad_dev->kobj);
 
        return 0;
 
@@ -932,7 +936,7 @@ static int ib_umad_sm_close(struct inode *inode, struct file *filp)
 
        up(&port->sm_sem);
 
-       kref_put(&port->umad_dev->ref, ib_umad_release_dev);
+       kobject_put(&port->umad_dev->kobj);
 
        return ret;
 }
@@ -1000,6 +1004,7 @@ static int find_overflow_devnum(void)
 }
 
 static int ib_umad_init_port(struct ib_device *device, int port_num,
+                            struct ib_umad_device *umad_dev,
                             struct ib_umad_port *port)
 {
        int devnum;
@@ -1032,6 +1037,7 @@ static int ib_umad_init_port(struct ib_device *device, int port_num,
 
        cdev_init(&port->cdev, &umad_fops);
        port->cdev.owner = THIS_MODULE;
+       port->cdev.kobj.parent = &umad_dev->kobj;
        kobject_set_name(&port->cdev.kobj, "umad%d", port->dev_num);
        if (cdev_add(&port->cdev, base, 1))
                goto err_cdev;
@@ -1050,6 +1056,7 @@ static int ib_umad_init_port(struct ib_device *device, int port_num,
        base += IB_UMAD_MAX_PORTS;
        cdev_init(&port->sm_cdev, &umad_sm_fops);
        port->sm_cdev.owner = THIS_MODULE;
+       port->sm_cdev.kobj.parent = &umad_dev->kobj;
        kobject_set_name(&port->sm_cdev.kobj, "issm%d", port->dev_num);
        if (cdev_add(&port->sm_cdev, base, 1))
                goto err_sm_cdev;
@@ -1143,7 +1150,7 @@ static void ib_umad_add_one(struct ib_device *device)
        if (!umad_dev)
                return;
 
-       kref_init(&umad_dev->ref);
+       kobject_init(&umad_dev->kobj, &ib_umad_dev_ktype);
 
        umad_dev->start_port = s;
        umad_dev->end_port   = e;
@@ -1151,7 +1158,8 @@ static void ib_umad_add_one(struct ib_device *device)
        for (i = s; i <= e; ++i) {
                umad_dev->port[i - s].umad_dev = umad_dev;
 
-               if (ib_umad_init_port(device, i, &umad_dev->port[i - s]))
+               if (ib_umad_init_port(device, i, umad_dev,
+                                     &umad_dev->port[i - s]))
                        goto err;
        }
 
@@ -1163,7 +1171,7 @@ err:
        while (--i >= s)
                ib_umad_kill_port(&umad_dev->port[i - s]);
 
-       kref_put(&umad_dev->ref, ib_umad_release_dev);
+       kobject_put(&umad_dev->kobj);
 }
 
 static void ib_umad_remove_one(struct ib_device *device)
@@ -1177,7 +1185,7 @@ static void ib_umad_remove_one(struct ib_device *device)
        for (i = 0; i <= umad_dev->end_port - umad_dev->start_port; ++i)
                ib_umad_kill_port(&umad_dev->port[i]);
 
-       kref_put(&umad_dev->ref, ib_umad_release_dev);
+       kobject_put(&umad_dev->kobj);
 }
 
 static char *umad_devnode(struct device *dev, umode_t *mode)