ibdev->dealloc_ucontext(file->ucontext); file->ucontext = NULL;  return -EFAULT; 
up(&file->mutex); return ret; 
ssize_t ib_uverbs_get_context(struct ib_uverbs_file *file,			      const char __user *buf,			      int in_len, int out_len){	struct ib_uverbs_get_context      cmd;	struct ib_uverbs_get_context_resp resp;	struct ib_udata                   udata;	struct ib_device                 *ibdev = file->device->ib_dev;	int i;	int ret = in_len;	if (out_len < sizeof resp)		return -ENOSPC;	if (copy_from_user(&cmd, buf, sizeof cmd))		return -EFAULT;	INIT_UDATA(&udata, buf + sizeof cmd,		   (unsigned long) cmd.response + sizeof resp,		   in_len - sizeof cmd, out_len - sizeof resp);	file->ucontext = ibdev->alloc_ucontext(ibdev, &udata);	if (IS_ERR(file->ucontext)) {		ret = PTR_ERR(file->ucontext);		file->ucontext = NULL;		return ret;	}	file->ucontext->device = ibdev;	INIT_LIST_HEAD(&file->ucontext->pd_list);	INIT_LIST_HEAD(&file->ucontext->mr_list);	INIT_LIST_HEAD(&file->ucontext->mw_list);	INIT_LIST_HEAD(&file->ucontext->cq_list);	INIT_LIST_HEAD(&file->ucontext->qp_list);	INIT_LIST_HEAD(&file->ucontext->srq_list);	INIT_LIST_HEAD(&file->ucontext->ah_list);	spin_lock_init(&file->ucontext->lock);	resp.async_fd = file->async_file.fd;	for (i = 0; i < file->device->num_comp; ++i)		if (copy_to_user((void __user *) (unsigned long) cmd.cq_fd_tab +				 i * sizeof (__u32),				 &file->comp_file[i].fd, sizeof (__u32)))			goto err;	if (copy_to_user((void __user *) (unsigned long) cmd.response,			 &resp, sizeof resp))		goto err;	return in_len;err:	ibdev->dealloc_ucontext(file->ucontext);	file->ucontext = NULL;	return -EFAULT;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/63c47c286d062d93e0501d60797274c84a587e97/uverbs_cmd.c/buggy/drivers/infiniband/core/uverbs_cmd.c