Skip to contentSkip to conversation

iw_cxgb3: Don't use mm after its freed in iwch_mmap().

PATCH Applied Steve Wise 2 participants 2 messages Mar 2, 2007 – Mar 6, 2007

Subsystems (3)
Networking Network drivers InfiniBand
lore
Share & tools
lore

Steve Wise

author
#0 lore raw

PATCH 1/1 iw_cxgb3: Don't use mm after its freed in iwch_mmap().

Don't use mm after its freed in iwch_mmap().

Signed-off-by Steve Wise <[email protected]>

---

 drivers/infiniband/hw/cxgb3/iwch_provider.c |   10 ++++++----
 1 files changed, 6 insertions(+), 4 deletions(-)
drivers/infiniband/hw/cxgb3/iwch_provider.c +6 -4
index 4af1c0f..f2774ae 100644
@@ -331,6 +331,7 @@ static int iwch_mmap(struct ib_ucontext 
 	int ret = 0;
 	struct iwch_mm_entry *mm;
 	struct iwch_ucontext *ucontext;
+	u64 addr;
 
 	PDBG("%s pgoff 0x%lx key 0x%x len %d\n", __FUNCTION__, vma->vm_pgoff,
 	     key, len);

@@ -345,10 +346,11 @@ static int iwch_mmap(struct ib_ucontext 
 	mm = remove_mmap(ucontext, key, len);
 	if (!mm)
 		return -EINVAL;
+	addr = mm->addr;
 	kfree(mm);
 
-	if ((mm->addr >= rdev_p->rnic_info.udbell_physbase) &&
-	    (mm->addr < (rdev_p->rnic_info.udbell_physbase +
+	if ((addr >= rdev_p->rnic_info.udbell_physbase) &&
+	    (addr < (rdev_p->rnic_info.udbell_physbase +
 		       rdev_p->rnic_info.udbell_len))) {
 
 		/*

@@ -362,7 +364,7 @@ static int iwch_mmap(struct ib_ucontext 
 		vma->vm_flags |= VM_DONTCOPY | VM_DONTEXPAND;
 		vma->vm_flags &= ~VM_MAYREAD;
 		ret = io_remap_pfn_range(vma, vma->vm_start,
-					 mm->addr >> PAGE_SHIFT,
+					 addr >> PAGE_SHIFT,
 				         len, vma->vm_page_prot);
 	} else {
 

@@ -370,7 +372,7 @@ static int iwch_mmap(struct ib_ucontext 
 		 * Map WQ or CQ contig dma memory...
 		 */
 		ret = remap_pfn_range(vma, vma->vm_start,
-				      mm->addr >> PAGE_SHIFT,
+				      addr >> PAGE_SHIFT,
 				      len, vma->vm_page_prot);
 	}