malhuda/msm-4.14
1
0
Fork 0
mirror of https://github.com/rd-stuffs/msm-4.14.git synced 2025-02-20 11:45:48 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

RDMA/cxgb3: Don't use mm after it's freed in iwch_mmap()

Browse Source 
Signed-off-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
This commit is contained in:
Steve Wise 2007-03-02 16:06:36 -06:00 committed by Roland Dreier
parent 7d526e6b2c
commit aeb100e246
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/infiniband/hw/cxgb3/iwch_provider.c
View File

@ -331,6 +331,7 @@ static int iwch_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
int ret = 0; int ret = 0;
struct iwch_mm_entry *mm; struct iwch_mm_entry *mm;
struct iwch_ucontext *ucontext; struct iwch_ucontext *ucontext;
u64 addr;
PDBG("%s pgoff 0x%lx key 0x%x len %d\n", __FUNCTION__, vma->vm_pgoff, PDBG("%s pgoff 0x%lx key 0x%x len %d\n", __FUNCTION__, vma->vm_pgoff,
key, len); key, len);
@ -345,10 +346,11 @@ static int iwch_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
mm = remove_mmap(ucontext, key, len); mm = remove_mmap(ucontext, key, len);
if (!mm) if (!mm)
return -EINVAL; return -EINVAL;
addr = mm->addr;
kfree(mm); kfree(mm);
if ((mm->addr >= rdev_p->rnic_info.udbell_physbase) && if ((addr >= rdev_p->rnic_info.udbell_physbase) &&
(mm->addr < (rdev_p->rnic_info.udbell_physbase + (addr < (rdev_p->rnic_info.udbell_physbase +
rdev_p->rnic_info.udbell_len))) { rdev_p->rnic_info.udbell_len))) {
/* /*
@ -362,7 +364,7 @@ static int iwch_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
vma->vm_flags |= VM_DONTCOPY | VM_DONTEXPAND; vma->vm_flags |= VM_DONTCOPY | VM_DONTEXPAND;
vma->vm_flags &= ~VM_MAYREAD; vma->vm_flags &= ~VM_MAYREAD;
ret = io_remap_pfn_range(vma, vma->vm_start, ret = io_remap_pfn_range(vma, vma->vm_start,
mm->addr >> PAGE_SHIFT, addr >> PAGE_SHIFT,
len, vma->vm_page_prot); len, vma->vm_page_prot);
} else { } else {
@ -370,7 +372,7 @@ static int iwch_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
* Map WQ or CQ contig dma memory... * Map WQ or CQ contig dma memory...
*/ */
ret = remap_pfn_range(vma, vma->vm_start, ret = remap_pfn_range(vma, vma->vm_start,
mm->addr >> PAGE_SHIFT, addr >> PAGE_SHIFT,
len, vma->vm_page_prot); len, vma->vm_page_prot);
} }