Avoid calling ib_dispatch_event on an inactive device in order to prevent writing to invalid I/O mapped addresses which could cause a guest crash.

Also, set the ib_active status to 'false' in pvrdma_pci_remove and in the failure path of pvrdma_pci_probe.

Fixes: 29c8d9eba550 ("IB: Add vmw_pvrdma driver") Acked-by: Adit Ranadive aditr@vmware.com Signed-off-by: Vishnu Dasa vdasa@vmware.com --- drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)

diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c index 780fd2dfc07e..ff4fd6e078e7 100644 --- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c +++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c @@ -692,6 +692,16 @@ static void pvrdma_netdevice_event_handle(struct pvrdma_dev *dev, struct pci_dev *pdev_net; unsigned int slot;

+ /* + * Do not dispatch events if the device is inactive. Otherwise + * we'll try to ib_dispatch_event() on an invalid device. + */ + if (!dev->ib_active) { + dev_dbg(&dev->pdev->dev, "ignore netdev event %ld on %s\n", + event, dev->ib_dev.name); + return; + } + switch (event) { case NETDEV_REBOOT: case NETDEV_DOWN: @@ -1049,6 +1059,7 @@ static int pvrdma_pci_probe(struct pci_dev *pdev, return 0;

err_unreg_ibdev: + dev->ib_active = false; ib_unregister_device(&dev->ib_dev); err_disable_intr: pvrdma_disable_intrs(dev); @@ -1108,6 +1119,7 @@ static void pvrdma_pci_remove(struct pci_dev *pdev) }

/* Unregister ib device */ + dev->ib_active = false; ib_unregister_device(&dev->ib_dev);

mutex_lock(&pvrdma_device_list_lock);