spin_lock_irq(&file->ucontext->lock); 
down(&file->mutex); 
ssize_t ib_uverbs_create_cq(struct ib_uverbs_file *file,			    const char __user *buf, int in_len,			    int out_len){	struct ib_uverbs_create_cq      cmd;	struct ib_uverbs_create_cq_resp resp;	struct ib_udata                 udata;	struct ib_ucq_object           *uobj;	struct ib_cq                   *cq;	int                             ret;	if (out_len < sizeof resp)		return -ENOSPC;	if (copy_from_user(&cmd, buf, sizeof cmd))		return -EFAULT;	INIT_UDATA(&udata, buf + sizeof cmd,		   (unsigned long) cmd.response + sizeof resp,		   in_len - sizeof cmd, out_len - sizeof resp);	if (cmd.event_handler >= file->device->num_comp)		return -EINVAL;	uobj = kmalloc(sizeof *uobj, GFP_KERNEL);	if (!uobj)		return -ENOMEM;	uobj->uobject.user_handle   = cmd.user_handle;	uobj->uobject.context       = file->ucontext;	uobj->comp_events_reported  = 0;	uobj->async_events_reported = 0;	INIT_LIST_HEAD(&uobj->comp_list);	INIT_LIST_HEAD(&uobj->async_list);	cq = file->device->ib_dev->create_cq(file->device->ib_dev, cmd.cqe,					     file->ucontext, &udata);	if (IS_ERR(cq)) {		ret = PTR_ERR(cq);		goto err;	}	cq->device        = file->device->ib_dev;	cq->uobject       = &uobj->uobject;	cq->comp_handler  = ib_uverbs_comp_handler;	cq->event_handler = ib_uverbs_cq_event_handler;	cq->cq_context    = file;	atomic_set(&cq->usecnt, 0);retry:	if (!idr_pre_get(&ib_uverbs_cq_idr, GFP_KERNEL)) {		ret = -ENOMEM;		goto err_cq;	}	down(&ib_uverbs_idr_mutex);	ret = idr_get_new(&ib_uverbs_cq_idr, cq, &uobj->uobject.id);	up(&ib_uverbs_idr_mutex);	if (ret == -EAGAIN)		goto retry;	if (ret)		goto err_cq;	spin_lock_irq(&file->ucontext->lock);	list_add_tail(&uobj->uobject.list, &file->ucontext->cq_list);	spin_unlock_irq(&file->ucontext->lock);	memset(&resp, 0, sizeof resp);	resp.cq_handle = uobj->uobject.id;	resp.cqe       = cq->cqe;	if (copy_to_user((void __user *) (unsigned long) cmd.response,			 &resp, sizeof resp)) {		ret = -EFAULT;		goto err_list;	}	return in_len;err_list: 	spin_lock_irq(&file->ucontext->lock);	list_del(&uobj->uobject.list);	spin_unlock_irq(&file->ucontext->lock);	down(&ib_uverbs_idr_mutex);	idr_remove(&ib_uverbs_cq_idr, uobj->uobject.id);	up(&ib_uverbs_idr_mutex);err_cq:	ib_destroy_cq(cq);err:	kfree(uobj);	return ret;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/63c47c286d062d93e0501d60797274c84a587e97/uverbs_cmd.c/buggy/drivers/infiniband/core/uverbs_cmd.c