spin_unlock_irq(&file->ucontext->lock); 
up(&file->mutex); 
ssize_t ib_uverbs_destroy_srq(struct ib_uverbs_file *file,			      const char __user *buf, int in_len,			      int out_len){	struct ib_uverbs_destroy_srq      cmd;	struct ib_uverbs_destroy_srq_resp resp;	struct ib_srq               	 *srq;	struct ib_uevent_object        	 *uobj;	struct ib_uverbs_event		 *evt, *tmp;	int                         	  ret = -EINVAL;	if (copy_from_user(&cmd, buf, sizeof cmd))		return -EFAULT;	down(&ib_uverbs_idr_mutex);	memset(&resp, 0, sizeof resp);	srq = idr_find(&ib_uverbs_srq_idr, cmd.srq_handle);	if (!srq || srq->uobject->context != file->ucontext)		goto out;	uobj = container_of(srq->uobject, struct ib_uevent_object, uobject);	ret = ib_destroy_srq(srq);	if (ret)		goto out;	idr_remove(&ib_uverbs_srq_idr, cmd.srq_handle);	spin_lock_irq(&file->ucontext->lock);	list_del(&uobj->uobject.list);	spin_unlock_irq(&file->ucontext->lock);	spin_lock_irq(&file->async_file.lock);	list_for_each_entry_safe(evt, tmp, &uobj->event_list, obj_list) {		list_del(&evt->list);		kfree(evt);	}	spin_unlock_irq(&file->async_file.lock);	resp.events_reported = uobj->events_reported;	kfree(uobj);	if (copy_to_user((void __user *) (unsigned long) cmd.response,			 &resp, sizeof resp))		ret = -EFAULT;out:	up(&ib_uverbs_idr_mutex);	return ret ? ret : in_len;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/63c47c286d062d93e0501d60797274c84a587e97/uverbs_cmd.c/buggy/drivers/infiniband/core/uverbs_cmd.c