aboutsummaryrefslogtreecommitdiff
path: root/drivers/infiniband/core
diff options
context:
space:
mode:
authorEli Cohen <eli@mellanox.co.il>2007-05-14 11:35:43 +0300
committerRoland Dreier <rolandd@cisco.com>2007-05-19 08:51:53 -0700
commit7b82cd8ee7374f803a3daf9a6cbc6eb4bbb10a63 (patch)
tree2ff12883dc0f1116a29c83d4396e8c965fcd13fe /drivers/infiniband/core
parent55b637c6a003a8c4850b41a2c2fd6942d8a7f530 (diff)
IB/core: Free umem when mm is already gone
Free umem when task's mm is already destroyed by the time ib_umem_release gets called. Found by Dotan Barak at Mellanox. Signed-off-by: Eli Cohen <eli@mellanox.co.il> Signed-off-by: Roland Dreier <rolandd@cisco.com>
Diffstat (limited to 'drivers/infiniband/core')
-rw-r--r--drivers/infiniband/core/umem.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index f32ca5fbb26..6009234e4f9 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -209,8 +209,10 @@ void ib_umem_release(struct ib_umem *umem)
__ib_umem_release(umem->context->device, umem, 1);
mm = get_task_mm(current);
- if (!mm)
+ if (!mm) {
+ kfree(umem);
return;
+ }
diff = PAGE_ALIGN(umem->length + umem->offset) >> PAGE_SHIFT;