Wait until all users have closed their device context before allowing
device unregistration to complete. This prevents a crash caused by
referring to stale data structures.
A better solution would be to have a way to revoke contexts rather
than waiting for userspace to close the context, but that's a much
bigger change that will have to wait. For now let's at least avoid
the crash.
Signed-off-by: Jack Morgenstein <jackm@mellanox.co.il>
Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
#include <linux/kref.h>
#include <linux/idr.h>
#include <linux/mutex.h>
#include <linux/kref.h>
#include <linux/idr.h>
#include <linux/mutex.h>
+#include <linux/completion.h>
#include <rdma/ib_verbs.h>
#include <rdma/ib_user_verbs.h>
#include <rdma/ib_verbs.h>
#include <rdma/ib_user_verbs.h>
struct ib_uverbs_device {
struct kref ref;
struct ib_uverbs_device {
struct kref ref;
+ struct completion comp;
int devnum;
struct cdev *dev;
struct class_device *class_dev;
int devnum;
struct cdev *dev;
struct class_device *class_dev;
struct ib_uverbs_device *dev =
container_of(ref, struct ib_uverbs_device, ref);
struct ib_uverbs_device *dev =
container_of(ref, struct ib_uverbs_device, ref);
}
void ib_uverbs_release_ucq(struct ib_uverbs_file *file,
}
void ib_uverbs_release_ucq(struct ib_uverbs_file *file,
return;
kref_init(&uverbs_dev->ref);
return;
kref_init(&uverbs_dev->ref);
+ init_completion(&uverbs_dev->comp);
spin_lock(&map_lock);
uverbs_dev->devnum = find_first_zero_bit(dev_map, IB_UVERBS_MAX_DEVICES);
spin_lock(&map_lock);
uverbs_dev->devnum = find_first_zero_bit(dev_map, IB_UVERBS_MAX_DEVICES);
err:
kref_put(&uverbs_dev->ref, ib_uverbs_release_dev);
err:
kref_put(&uverbs_dev->ref, ib_uverbs_release_dev);
+ wait_for_completion(&uverbs_dev->comp);
+ kfree(uverbs_dev);
spin_unlock(&map_lock);
clear_bit(uverbs_dev->devnum, dev_map);
spin_unlock(&map_lock);
clear_bit(uverbs_dev->devnum, dev_map);
kref_put(&uverbs_dev->ref, ib_uverbs_release_dev);
kref_put(&uverbs_dev->ref, ib_uverbs_release_dev);
+ wait_for_completion(&uverbs_dev->comp);
+ kfree(uverbs_dev);
}
static int uverbs_event_get_sb(struct file_system_type *fs_type, int flags,
}
static int uverbs_event_get_sb(struct file_system_type *fs_type, int flags,