From: Eli Cohen <eli@mellanox.co.il>
Date: Mon, 14 May 2007 08:35:43 +0000 (+0300)
Subject: IB/core: Free umem when mm is already gone
X-Git-Tag: v2.6.22-rc3~108^2~18
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7b82cd8ee7374f803a3daf9a6cbc6eb4bbb10a63;p=linux-2.6

IB/core: Free umem when mm is already gone

Free umem when task's mm is already destroyed by the time
ib_umem_release gets called.

Found by Dotan Barak at Mellanox.

Signed-off-by: Eli Cohen <eli@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
---

diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index f32ca5fbb2..6009234e4f 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -209,8 +209,10 @@ void ib_umem_release(struct ib_umem *umem)
 	__ib_umem_release(umem->context->device, umem, 1);
 
 	mm = get_task_mm(current);
-	if (!mm)
+	if (!mm) {
+		kfree(umem);
 		return;
+	}
 
 	diff = PAGE_ALIGN(umem->length + umem->offset) >> PAGE_SHIFT;