[PATCH] IB: fix use-after-free in user verbs cleanup
[linux-2.6] / drivers / infiniband / core / uverbs_main.c
1 /*
2  * Copyright (c) 2005 Topspin Communications.  All rights reserved.
3  * Copyright (c) 2005 Cisco Systems.  All rights reserved.
4  *
5  * This software is available to you under a choice of one of two
6  * licenses.  You may choose to be licensed under the terms of the GNU
7  * General Public License (GPL) Version 2, available from the file
8  * COPYING in the main directory of this source tree, or the
9  * OpenIB.org BSD license below:
10  *
11  *     Redistribution and use in source and binary forms, with or
12  *     without modification, are permitted provided that the following
13  *     conditions are met:
14  *
15  *      - Redistributions of source code must retain the above
16  *        copyright notice, this list of conditions and the following
17  *        disclaimer.
18  *
19  *      - Redistributions in binary form must reproduce the above
20  *        copyright notice, this list of conditions and the following
21  *        disclaimer in the documentation and/or other materials
22  *        provided with the distribution.
23  *
24  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
25  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
26  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
27  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
28  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
29  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
30  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
31  * SOFTWARE.
32  *
33  * $Id: uverbs_main.c 2733 2005-06-28 19:14:34Z roland $
34  */
35
36 #include <linux/module.h>
37 #include <linux/init.h>
38 #include <linux/device.h>
39 #include <linux/err.h>
40 #include <linux/fs.h>
41 #include <linux/poll.h>
42 #include <linux/file.h>
43 #include <linux/mount.h>
44
45 #include <asm/uaccess.h>
46
47 #include "uverbs.h"
48
49 MODULE_AUTHOR("Roland Dreier");
50 MODULE_DESCRIPTION("InfiniBand userspace verbs access");
51 MODULE_LICENSE("Dual BSD/GPL");
52
53 #define INFINIBANDEVENTFS_MAGIC 0x49426576      /* "IBev" */
54
55 enum {
56         IB_UVERBS_MAJOR       = 231,
57         IB_UVERBS_BASE_MINOR  = 192,
58         IB_UVERBS_MAX_DEVICES = 32
59 };
60
61 #define IB_UVERBS_BASE_DEV      MKDEV(IB_UVERBS_MAJOR, IB_UVERBS_BASE_MINOR)
62
63 DECLARE_MUTEX(ib_uverbs_idr_mutex);
64 DEFINE_IDR(ib_uverbs_pd_idr);
65 DEFINE_IDR(ib_uverbs_mr_idr);
66 DEFINE_IDR(ib_uverbs_mw_idr);
67 DEFINE_IDR(ib_uverbs_ah_idr);
68 DEFINE_IDR(ib_uverbs_cq_idr);
69 DEFINE_IDR(ib_uverbs_qp_idr);
70
71 static spinlock_t map_lock;
72 static DECLARE_BITMAP(dev_map, IB_UVERBS_MAX_DEVICES);
73
74 static ssize_t (*uverbs_cmd_table[])(struct ib_uverbs_file *file,
75                                      const char __user *buf, int in_len,
76                                      int out_len) = {
77         [IB_USER_VERBS_CMD_QUERY_PARAMS]  = ib_uverbs_query_params,
78         [IB_USER_VERBS_CMD_GET_CONTEXT]   = ib_uverbs_get_context,
79         [IB_USER_VERBS_CMD_QUERY_DEVICE]  = ib_uverbs_query_device,
80         [IB_USER_VERBS_CMD_QUERY_PORT]    = ib_uverbs_query_port,
81         [IB_USER_VERBS_CMD_QUERY_GID]     = ib_uverbs_query_gid,
82         [IB_USER_VERBS_CMD_QUERY_PKEY]    = ib_uverbs_query_pkey,
83         [IB_USER_VERBS_CMD_ALLOC_PD]      = ib_uverbs_alloc_pd,
84         [IB_USER_VERBS_CMD_DEALLOC_PD]    = ib_uverbs_dealloc_pd,
85         [IB_USER_VERBS_CMD_REG_MR]        = ib_uverbs_reg_mr,
86         [IB_USER_VERBS_CMD_DEREG_MR]      = ib_uverbs_dereg_mr,
87         [IB_USER_VERBS_CMD_CREATE_CQ]     = ib_uverbs_create_cq,
88         [IB_USER_VERBS_CMD_DESTROY_CQ]    = ib_uverbs_destroy_cq,
89         [IB_USER_VERBS_CMD_CREATE_QP]     = ib_uverbs_create_qp,
90         [IB_USER_VERBS_CMD_MODIFY_QP]     = ib_uverbs_modify_qp,
91         [IB_USER_VERBS_CMD_DESTROY_QP]    = ib_uverbs_destroy_qp,
92         [IB_USER_VERBS_CMD_ATTACH_MCAST]  = ib_uverbs_attach_mcast,
93         [IB_USER_VERBS_CMD_DETACH_MCAST]  = ib_uverbs_detach_mcast,
94 };
95
96 static struct vfsmount *uverbs_event_mnt;
97
98 static void ib_uverbs_add_one(struct ib_device *device);
99 static void ib_uverbs_remove_one(struct ib_device *device);
100
101 static int ib_dealloc_ucontext(struct ib_ucontext *context)
102 {
103         struct ib_uobject *uobj, *tmp;
104
105         if (!context)
106                 return 0;
107
108         down(&ib_uverbs_idr_mutex);
109
110         /* XXX Free AHs */
111
112         list_for_each_entry_safe(uobj, tmp, &context->qp_list, list) {
113                 struct ib_qp *qp = idr_find(&ib_uverbs_qp_idr, uobj->id);
114                 idr_remove(&ib_uverbs_qp_idr, uobj->id);
115                 ib_destroy_qp(qp);
116                 list_del(&uobj->list);
117                 kfree(uobj);
118         }
119
120         list_for_each_entry_safe(uobj, tmp, &context->cq_list, list) {
121                 struct ib_cq *cq = idr_find(&ib_uverbs_cq_idr, uobj->id);
122                 idr_remove(&ib_uverbs_cq_idr, uobj->id);
123                 ib_destroy_cq(cq);
124                 list_del(&uobj->list);
125                 kfree(uobj);
126         }
127
128         /* XXX Free SRQs */
129         /* XXX Free MWs */
130
131         list_for_each_entry_safe(uobj, tmp, &context->mr_list, list) {
132                 struct ib_mr *mr = idr_find(&ib_uverbs_mr_idr, uobj->id);
133                 struct ib_device *mrdev = mr->device;
134                 struct ib_umem_object *memobj;
135
136                 idr_remove(&ib_uverbs_mr_idr, uobj->id);
137                 ib_dereg_mr(mr);
138
139                 memobj = container_of(uobj, struct ib_umem_object, uobject);
140                 ib_umem_release_on_close(mrdev, &memobj->umem);
141
142                 list_del(&uobj->list);
143                 kfree(memobj);
144         }
145
146         list_for_each_entry_safe(uobj, tmp, &context->pd_list, list) {
147                 struct ib_pd *pd = idr_find(&ib_uverbs_pd_idr, uobj->id);
148                 idr_remove(&ib_uverbs_pd_idr, uobj->id);
149                 ib_dealloc_pd(pd);
150                 list_del(&uobj->list);
151                 kfree(uobj);
152         }
153
154         up(&ib_uverbs_idr_mutex);
155
156         return context->device->dealloc_ucontext(context);
157 }
158
159 static void ib_uverbs_release_file(struct kref *ref)
160 {
161         struct ib_uverbs_file *file =
162                 container_of(ref, struct ib_uverbs_file, ref);
163
164         module_put(file->device->ib_dev->owner);
165         kfree(file);
166 }
167
168 static ssize_t ib_uverbs_event_read(struct file *filp, char __user *buf,
169                                     size_t count, loff_t *pos)
170 {
171         struct ib_uverbs_event_file *file = filp->private_data;
172         void *event;
173         int eventsz;
174         int ret = 0;
175
176         spin_lock_irq(&file->lock);
177
178         while (list_empty(&file->event_list) && file->fd >= 0) {
179                 spin_unlock_irq(&file->lock);
180
181                 if (filp->f_flags & O_NONBLOCK)
182                         return -EAGAIN;
183
184                 if (wait_event_interruptible(file->poll_wait,
185                                              !list_empty(&file->event_list) ||
186                                              file->fd < 0))
187                         return -ERESTARTSYS;
188
189                 spin_lock_irq(&file->lock);
190         }
191
192         if (file->fd < 0) {
193                 spin_unlock_irq(&file->lock);
194                 return -ENODEV;
195         }
196
197         if (file->is_async) {
198                 event   = list_entry(file->event_list.next,
199                                      struct ib_uverbs_async_event, list);
200                 eventsz = sizeof (struct ib_uverbs_async_event_desc);
201         } else {
202                 event   = list_entry(file->event_list.next,
203                                      struct ib_uverbs_comp_event, list);
204                 eventsz = sizeof (struct ib_uverbs_comp_event_desc);
205         }
206
207         if (eventsz > count) {
208                 ret   = -EINVAL;
209                 event = NULL;
210         } else
211                 list_del(file->event_list.next);
212
213         spin_unlock_irq(&file->lock);
214
215         if (event) {
216                 if (copy_to_user(buf, event, eventsz))
217                         ret = -EFAULT;
218                 else
219                         ret = eventsz;
220         }
221
222         kfree(event);
223
224         return ret;
225 }
226
227 static unsigned int ib_uverbs_event_poll(struct file *filp,
228                                          struct poll_table_struct *wait)
229 {
230         unsigned int pollflags = 0;
231         struct ib_uverbs_event_file *file = filp->private_data;
232
233         poll_wait(filp, &file->poll_wait, wait);
234
235         spin_lock_irq(&file->lock);
236         if (file->fd < 0)
237                 pollflags = POLLERR;
238         else if (!list_empty(&file->event_list))
239                 pollflags = POLLIN | POLLRDNORM;
240         spin_unlock_irq(&file->lock);
241
242         return pollflags;
243 }
244
245 static void ib_uverbs_event_release(struct ib_uverbs_event_file *file)
246 {
247         struct list_head *entry, *tmp;
248
249         spin_lock_irq(&file->lock);
250         if (file->fd != -1) {
251                 file->fd = -1;
252                 list_for_each_safe(entry, tmp, &file->event_list)
253                         if (file->is_async)
254                                 kfree(list_entry(entry, struct ib_uverbs_async_event, list));
255                         else
256                                 kfree(list_entry(entry, struct ib_uverbs_comp_event, list));
257         }
258         spin_unlock_irq(&file->lock);
259 }
260
261 static int ib_uverbs_event_fasync(int fd, struct file *filp, int on)
262 {
263         struct ib_uverbs_event_file *file = filp->private_data;
264
265         return fasync_helper(fd, filp, on, &file->async_queue);
266 }
267
268 static int ib_uverbs_event_close(struct inode *inode, struct file *filp)
269 {
270         struct ib_uverbs_event_file *file = filp->private_data;
271
272         ib_uverbs_event_release(file);
273         ib_uverbs_event_fasync(-1, filp, 0);
274         kref_put(&file->uverbs_file->ref, ib_uverbs_release_file);
275
276         return 0;
277 }
278
279 static struct file_operations uverbs_event_fops = {
280         /*
281          * No .owner field since we artificially create event files,
282          * so there is no increment to the module reference count in
283          * the open path.  All event files come from a uverbs command
284          * file, which already takes a module reference, so this is OK.
285          */
286         .read    = ib_uverbs_event_read,
287         .poll    = ib_uverbs_event_poll,
288         .release = ib_uverbs_event_close,
289         .fasync  = ib_uverbs_event_fasync
290 };
291
292 void ib_uverbs_comp_handler(struct ib_cq *cq, void *cq_context)
293 {
294         struct ib_uverbs_file       *file = cq_context;
295         struct ib_uverbs_comp_event *entry;
296         unsigned long                flags;
297
298         entry = kmalloc(sizeof *entry, GFP_ATOMIC);
299         if (!entry)
300                 return;
301
302         entry->desc.cq_handle = cq->uobject->user_handle;
303
304         spin_lock_irqsave(&file->comp_file[0].lock, flags);
305         list_add_tail(&entry->list, &file->comp_file[0].event_list);
306         spin_unlock_irqrestore(&file->comp_file[0].lock, flags);
307
308         wake_up_interruptible(&file->comp_file[0].poll_wait);
309         kill_fasync(&file->comp_file[0].async_queue, SIGIO, POLL_IN);
310 }
311
312 static void ib_uverbs_async_handler(struct ib_uverbs_file *file,
313                                     __u64 element, __u64 event)
314 {
315         struct ib_uverbs_async_event *entry;
316         unsigned long flags;
317
318         entry = kmalloc(sizeof *entry, GFP_ATOMIC);
319         if (!entry)
320                 return;
321
322         entry->desc.element    = element;
323         entry->desc.event_type = event;
324
325         spin_lock_irqsave(&file->async_file.lock, flags);
326         list_add_tail(&entry->list, &file->async_file.event_list);
327         spin_unlock_irqrestore(&file->async_file.lock, flags);
328
329         wake_up_interruptible(&file->async_file.poll_wait);
330         kill_fasync(&file->async_file.async_queue, SIGIO, POLL_IN);
331 }
332
333 void ib_uverbs_cq_event_handler(struct ib_event *event, void *context_ptr)
334 {
335         ib_uverbs_async_handler(context_ptr,
336                                 event->element.cq->uobject->user_handle,
337                                 event->event);
338 }
339
340 void ib_uverbs_qp_event_handler(struct ib_event *event, void *context_ptr)
341 {
342         ib_uverbs_async_handler(context_ptr,
343                                 event->element.qp->uobject->user_handle,
344                                 event->event);
345 }
346
347 static void ib_uverbs_event_handler(struct ib_event_handler *handler,
348                                     struct ib_event *event)
349 {
350         struct ib_uverbs_file *file =
351                 container_of(handler, struct ib_uverbs_file, event_handler);
352
353         ib_uverbs_async_handler(file, event->element.port_num, event->event);
354 }
355
356 static int ib_uverbs_event_init(struct ib_uverbs_event_file *file,
357                                 struct ib_uverbs_file *uverbs_file)
358 {
359         struct file *filp;
360
361         spin_lock_init(&file->lock);
362         INIT_LIST_HEAD(&file->event_list);
363         init_waitqueue_head(&file->poll_wait);
364         file->uverbs_file = uverbs_file;
365         file->async_queue = NULL;
366
367         file->fd = get_unused_fd();
368         if (file->fd < 0)
369                 return file->fd;
370
371         filp = get_empty_filp();
372         if (!filp) {
373                 put_unused_fd(file->fd);
374                 return -ENFILE;
375         }
376
377         filp->f_op         = &uverbs_event_fops;
378         filp->f_vfsmnt     = mntget(uverbs_event_mnt);
379         filp->f_dentry     = dget(uverbs_event_mnt->mnt_root);
380         filp->f_mapping    = filp->f_dentry->d_inode->i_mapping;
381         filp->f_flags      = O_RDONLY;
382         filp->f_mode       = FMODE_READ;
383         filp->private_data = file;
384
385         fd_install(file->fd, filp);
386
387         return 0;
388 }
389
390 static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
391                              size_t count, loff_t *pos)
392 {
393         struct ib_uverbs_file *file = filp->private_data;
394         struct ib_uverbs_cmd_hdr hdr;
395
396         if (count < sizeof hdr)
397                 return -EINVAL;
398
399         if (copy_from_user(&hdr, buf, sizeof hdr))
400                 return -EFAULT;
401
402         if (hdr.in_words * 4 != count)
403                 return -EINVAL;
404
405         if (hdr.command < 0 || hdr.command >= ARRAY_SIZE(uverbs_cmd_table))
406                 return -EINVAL;
407
408         if (!file->ucontext                               &&
409             hdr.command != IB_USER_VERBS_CMD_QUERY_PARAMS &&
410             hdr.command != IB_USER_VERBS_CMD_GET_CONTEXT)
411                 return -EINVAL;
412
413         return uverbs_cmd_table[hdr.command](file, buf + sizeof hdr,
414                                              hdr.in_words * 4, hdr.out_words * 4);
415 }
416
417 static int ib_uverbs_mmap(struct file *filp, struct vm_area_struct *vma)
418 {
419         struct ib_uverbs_file *file = filp->private_data;
420
421         if (!file->ucontext)
422                 return -ENODEV;
423         else
424                 return file->device->ib_dev->mmap(file->ucontext, vma);
425 }
426
427 static int ib_uverbs_open(struct inode *inode, struct file *filp)
428 {
429         struct ib_uverbs_device *dev =
430                 container_of(inode->i_cdev, struct ib_uverbs_device, dev);
431         struct ib_uverbs_file *file;
432         int i = 0;
433         int ret;
434
435         if (!try_module_get(dev->ib_dev->owner))
436                 return -ENODEV;
437
438         file = kmalloc(sizeof *file +
439                        (dev->num_comp - 1) * sizeof (struct ib_uverbs_event_file),
440                        GFP_KERNEL);
441         if (!file)
442                 return -ENOMEM;
443
444         file->device = dev;
445         kref_init(&file->ref);
446
447         file->ucontext = NULL;
448
449         ret = ib_uverbs_event_init(&file->async_file, file);
450         if (ret)
451                 goto err;
452
453         file->async_file.is_async = 1;
454
455         kref_get(&file->ref);
456
457         for (i = 0; i < dev->num_comp; ++i) {
458                 ret = ib_uverbs_event_init(&file->comp_file[i], file);
459                 if (ret)
460                         goto err_async;
461                 kref_get(&file->ref);
462                 file->comp_file[i].is_async = 0;
463         }
464
465
466         filp->private_data = file;
467
468         INIT_IB_EVENT_HANDLER(&file->event_handler, dev->ib_dev,
469                               ib_uverbs_event_handler);
470         if (ib_register_event_handler(&file->event_handler))
471                 goto err_async;
472
473         return 0;
474
475 err_async:
476         while (i--)
477                 ib_uverbs_event_release(&file->comp_file[i]);
478
479         ib_uverbs_event_release(&file->async_file);
480
481 err:
482         kref_put(&file->ref, ib_uverbs_release_file);
483
484         return ret;
485 }
486
487 static int ib_uverbs_close(struct inode *inode, struct file *filp)
488 {
489         struct ib_uverbs_file *file = filp->private_data;
490         int i;
491
492         ib_unregister_event_handler(&file->event_handler);
493         ib_uverbs_event_release(&file->async_file);
494         ib_dealloc_ucontext(file->ucontext);
495
496         for (i = 0; i < file->device->num_comp; ++i)
497                 ib_uverbs_event_release(&file->comp_file[i]);
498
499         kref_put(&file->ref, ib_uverbs_release_file);
500
501         return 0;
502 }
503
504 static struct file_operations uverbs_fops = {
505         .owner   = THIS_MODULE,
506         .write   = ib_uverbs_write,
507         .open    = ib_uverbs_open,
508         .release = ib_uverbs_close
509 };
510
511 static struct file_operations uverbs_mmap_fops = {
512         .owner   = THIS_MODULE,
513         .write   = ib_uverbs_write,
514         .mmap    = ib_uverbs_mmap,
515         .open    = ib_uverbs_open,
516         .release = ib_uverbs_close
517 };
518
519 static struct ib_client uverbs_client = {
520         .name   = "uverbs",
521         .add    = ib_uverbs_add_one,
522         .remove = ib_uverbs_remove_one
523 };
524
525 static ssize_t show_ibdev(struct class_device *class_dev, char *buf)
526 {
527         struct ib_uverbs_device *dev =
528                 container_of(class_dev, struct ib_uverbs_device, class_dev);
529
530         return sprintf(buf, "%s\n", dev->ib_dev->name);
531 }
532 static CLASS_DEVICE_ATTR(ibdev, S_IRUGO, show_ibdev, NULL);
533
534 static void ib_uverbs_release_class_dev(struct class_device *class_dev)
535 {
536         struct ib_uverbs_device *dev =
537                 container_of(class_dev, struct ib_uverbs_device, class_dev);
538
539         cdev_del(&dev->dev);
540         clear_bit(dev->devnum, dev_map);
541         kfree(dev);
542 }
543
544 static struct class uverbs_class = {
545         .name    = "infiniband_verbs",
546         .release = ib_uverbs_release_class_dev
547 };
548
549 static ssize_t show_abi_version(struct class *class, char *buf)
550 {
551         return sprintf(buf, "%d\n", IB_USER_VERBS_ABI_VERSION);
552 }
553 static CLASS_ATTR(abi_version, S_IRUGO, show_abi_version, NULL);
554
555 static void ib_uverbs_add_one(struct ib_device *device)
556 {
557         struct ib_uverbs_device *uverbs_dev;
558
559         if (!device->alloc_ucontext)
560                 return;
561
562         uverbs_dev = kmalloc(sizeof *uverbs_dev, GFP_KERNEL);
563         if (!uverbs_dev)
564                 return;
565
566         memset(uverbs_dev, 0, sizeof *uverbs_dev);
567
568         spin_lock(&map_lock);
569         uverbs_dev->devnum = find_first_zero_bit(dev_map, IB_UVERBS_MAX_DEVICES);
570         if (uverbs_dev->devnum >= IB_UVERBS_MAX_DEVICES) {
571                 spin_unlock(&map_lock);
572                 goto err;
573         }
574         set_bit(uverbs_dev->devnum, dev_map);
575         spin_unlock(&map_lock);
576
577         uverbs_dev->ib_dev   = device;
578         uverbs_dev->num_comp = 1;
579
580         if (device->mmap)
581                 cdev_init(&uverbs_dev->dev, &uverbs_mmap_fops);
582         else
583                 cdev_init(&uverbs_dev->dev, &uverbs_fops);
584         uverbs_dev->dev.owner = THIS_MODULE;
585         kobject_set_name(&uverbs_dev->dev.kobj, "uverbs%d", uverbs_dev->devnum);
586         if (cdev_add(&uverbs_dev->dev, IB_UVERBS_BASE_DEV + uverbs_dev->devnum, 1))
587                 goto err;
588
589         uverbs_dev->class_dev.class = &uverbs_class;
590         uverbs_dev->class_dev.dev   = device->dma_device;
591         uverbs_dev->class_dev.devt  = uverbs_dev->dev.dev;
592         snprintf(uverbs_dev->class_dev.class_id, BUS_ID_SIZE, "uverbs%d", uverbs_dev->devnum);
593         if (class_device_register(&uverbs_dev->class_dev))
594                 goto err_cdev;
595
596         if (class_device_create_file(&uverbs_dev->class_dev, &class_device_attr_ibdev))
597                 goto err_class;
598
599         ib_set_client_data(device, &uverbs_client, uverbs_dev);
600
601         return;
602
603 err_class:
604         class_device_unregister(&uverbs_dev->class_dev);
605
606 err_cdev:
607         cdev_del(&uverbs_dev->dev);
608         clear_bit(uverbs_dev->devnum, dev_map);
609
610 err:
611         kfree(uverbs_dev);
612         return;
613 }
614
615 static void ib_uverbs_remove_one(struct ib_device *device)
616 {
617         struct ib_uverbs_device *uverbs_dev = ib_get_client_data(device, &uverbs_client);
618
619         if (!uverbs_dev)
620                 return;
621
622         class_device_unregister(&uverbs_dev->class_dev);
623 }
624
625 static struct super_block *uverbs_event_get_sb(struct file_system_type *fs_type, int flags,
626                                                const char *dev_name, void *data)
627 {
628         return get_sb_pseudo(fs_type, "infinibandevent:", NULL,
629                              INFINIBANDEVENTFS_MAGIC);
630 }
631
632 static struct file_system_type uverbs_event_fs = {
633         /* No owner field so module can be unloaded */
634         .name    = "infinibandeventfs",
635         .get_sb  = uverbs_event_get_sb,
636         .kill_sb = kill_litter_super
637 };
638
639 static int __init ib_uverbs_init(void)
640 {
641         int ret;
642
643         spin_lock_init(&map_lock);
644
645         ret = register_chrdev_region(IB_UVERBS_BASE_DEV, IB_UVERBS_MAX_DEVICES,
646                                      "infiniband_verbs");
647         if (ret) {
648                 printk(KERN_ERR "user_verbs: couldn't register device number\n");
649                 goto out;
650         }
651
652         ret = class_register(&uverbs_class);
653         if (ret) {
654                 printk(KERN_ERR "user_verbs: couldn't create class infiniband_verbs\n");
655                 goto out_chrdev;
656         }
657
658         ret = class_create_file(&uverbs_class, &class_attr_abi_version);
659         if (ret) {
660                 printk(KERN_ERR "user_verbs: couldn't create abi_version attribute\n");
661                 goto out_class;
662         }
663
664         ret = register_filesystem(&uverbs_event_fs);
665         if (ret) {
666                 printk(KERN_ERR "user_verbs: couldn't register infinibandeventfs\n");
667                 goto out_class;
668         }
669
670         uverbs_event_mnt = kern_mount(&uverbs_event_fs);
671         if (IS_ERR(uverbs_event_mnt)) {
672                 ret = PTR_ERR(uverbs_event_mnt);
673                 printk(KERN_ERR "user_verbs: couldn't mount infinibandeventfs\n");
674                 goto out_fs;
675         }
676
677         ret = ib_register_client(&uverbs_client);
678         if (ret) {
679                 printk(KERN_ERR "user_verbs: couldn't register client\n");
680                 goto out_mnt;
681         }
682
683         return 0;
684
685 out_mnt:
686         mntput(uverbs_event_mnt);
687
688 out_fs:
689         unregister_filesystem(&uverbs_event_fs);
690
691 out_class:
692         class_unregister(&uverbs_class);
693
694 out_chrdev:
695         unregister_chrdev_region(IB_UVERBS_BASE_DEV, IB_UVERBS_MAX_DEVICES);
696
697 out:
698         return ret;
699 }
700
701 static void __exit ib_uverbs_cleanup(void)
702 {
703         ib_unregister_client(&uverbs_client);
704         mntput(uverbs_event_mnt);
705         unregister_filesystem(&uverbs_event_fs);
706         class_unregister(&uverbs_class);
707         unregister_chrdev_region(IB_UVERBS_BASE_DEV, IB_UVERBS_MAX_DEVICES);
708 }
709
710 module_init(ib_uverbs_init);
711 module_exit(ib_uverbs_cleanup);