Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7b82cd8e authored by Eli Cohen's avatar Eli Cohen Committed by Roland Dreier
Browse files

IB/core: Free umem when mm is already gone 



Free umem when task's mm is already destroyed by the time
ib_umem_release gets called.

Found by Dotan Barak at Mellanox.

Signed-off-by: default avatarEli Cohen <eli@mellanox.co.il>
Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
parent 55b637c6

drivers/infiniband/core/umem.c

+3 −1
Original line number Original line Diff line number Diff line
@@ -209,8 +209,10 @@ void ib_umem_release(struct ib_umem *umem) 
	__ib_umem_release(umem->context->device, umem, 1);

	__ib_umem_release(umem->context->device, umem, 1);





	mm = get_task_mm(current);

	mm = get_task_mm(current);

	if (!mm)

	if (!mm) {

		kfree(umem);

		return;

		return;

	}





	diff = PAGE_ALIGN(umem->length + umem->offset) >> PAGE_SHIFT;

	diff = PAGE_ALIGN(umem->length + umem->offset) >> PAGE_SHIFT;