IB/core: Free umem when mm is already gone
authorEli Cohen <eli@mellanox.co.il>
Mon, 14 May 2007 08:35:43 +0000 (11:35 +0300)
committerRoland Dreier <rolandd@cisco.com>
Sat, 19 May 2007 15:51:53 +0000 (08:51 -0700)
Free umem when task's mm is already destroyed by the time
ib_umem_release gets called.

Found by Dotan Barak at Mellanox.

Signed-off-by: Eli Cohen <eli@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
drivers/infiniband/core/umem.c

index f32ca5fbb26bcc56b02cd8c97bfa39bce1f3c63b..6009234e4f9e03b944da72b1070ed9530b6c6cd5 100644 (file)
@@ -209,8 +209,10 @@ void ib_umem_release(struct ib_umem *umem)
        __ib_umem_release(umem->context->device, umem, 1);
 
        mm = get_task_mm(current);
-       if (!mm)
+       if (!mm) {
+               kfree(umem);
                return;
+       }
 
        diff = PAGE_ALIGN(umem->length + umem->offset) >> PAGE_SHIFT;