RDMA/cxgb3: Don't use mm after it's freed in iwch_mmap()

[powerpc.git] / drivers / infiniband / hw / cxgb3 / iwch_provider.c

diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.c b/drivers/infiniband/hw/cxgb3/iwch_provider.c
index 6861087..b357c11 100644 (file)
--- a/drivers/infiniband/hw/cxgb3/iwch_provider.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.c
@@ -1,6 +1,5 @@
 /*
  * Copyright (c) 2006 Chelsio, Inc. All rights reserved.
- * Copyright (c) 2006 Open Grid Computing, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -332,6 +331,7 @@ static int iwch_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
        int ret = 0;
        struct iwch_mm_entry *mm;
        struct iwch_ucontext *ucontext;
+       u64 addr;
 
        PDBG("%s pgoff 0x%lx key 0x%x len %d\n", __FUNCTION__, vma->vm_pgoff,
             key, len);
@@ -346,10 +346,11 @@ static int iwch_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
        mm = remove_mmap(ucontext, key, len);
        if (!mm)
                return -EINVAL;
+       addr = mm->addr;
        kfree(mm);
 
-       if ((mm->addr >= rdev_p->rnic_info.udbell_physbase) &&
-           (mm->addr < (rdev_p->rnic_info.udbell_physbase +
+       if ((addr >= rdev_p->rnic_info.udbell_physbase) &&
+           (addr < (rdev_p->rnic_info.udbell_physbase +
                       rdev_p->rnic_info.udbell_len))) {
 
                /*
@@ -363,7 +364,7 @@ static int iwch_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
                vma->vm_flags |= VM_DONTCOPY | VM_DONTEXPAND;
                vma->vm_flags &= ~VM_MAYREAD;
                ret = io_remap_pfn_range(vma, vma->vm_start,
-                                        mm->addr >> PAGE_SHIFT,
+                                        addr >> PAGE_SHIFT,
                                         len, vma->vm_page_prot);
        } else {
 
@@ -371,7 +372,7 @@ static int iwch_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
                 * Map WQ or CQ contig dma memory...
                 */
                ret = remap_pfn_range(vma, vma->vm_start,
-                                     mm->addr >> PAGE_SHIFT,
+                                     addr >> PAGE_SHIFT,
                                      len, vma->vm_page_prot);
        }
 
@@ -949,7 +950,7 @@ void iwch_qp_rem_ref(struct ib_qp *qp)
                wake_up(&(to_iwch_qp(qp)->wait));
 }
 
-struct ib_qp *iwch_get_qp(struct ib_device *dev, int qpn)
+static struct ib_qp *iwch_get_qp(struct ib_device *dev, int qpn)
 {
        PDBG("%s ib_dev %p qpn 0x%x\n", __FUNCTION__, dev, qpn);
        return (struct ib_qp *)get_qhp(to_iwch_dev(dev), qpn);