spin_unlock_irq(&file->ucontext->lock); 
up(&file->mutex); 
ssize_t ib_uverbs_create_srq(struct ib_uverbs_file *file,			     const char __user *buf, int in_len,			     int out_len){	struct ib_uverbs_create_srq      cmd;	struct ib_uverbs_create_srq_resp resp;	struct ib_udata                  udata;	struct ib_uevent_object         *uobj;	struct ib_pd                    *pd;	struct ib_srq                   *srq;	struct ib_srq_init_attr          attr;	int ret;	if (out_len < sizeof resp)		return -ENOSPC;	if (copy_from_user(&cmd, buf, sizeof cmd))		return -EFAULT;	INIT_UDATA(&udata, buf + sizeof cmd,		   (unsigned long) cmd.response + sizeof resp,		   in_len - sizeof cmd, out_len - sizeof resp);	uobj = kmalloc(sizeof *uobj, GFP_KERNEL);	if (!uobj)		return -ENOMEM;	down(&ib_uverbs_idr_mutex);	pd  = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);	if (!pd || pd->uobject->context != file->ucontext) {		ret = -EINVAL;		goto err_up;	}	attr.event_handler  = ib_uverbs_srq_event_handler;	attr.srq_context    = file;	attr.attr.max_wr    = cmd.max_wr;	attr.attr.max_sge   = cmd.max_sge;	attr.attr.srq_limit = cmd.srq_limit;	uobj->uobject.user_handle = cmd.user_handle;	uobj->uobject.context     = file->ucontext;	uobj->events_reported     = 0;	INIT_LIST_HEAD(&uobj->event_list);	srq = pd->device->create_srq(pd, &attr, &udata);	if (IS_ERR(srq)) {		ret = PTR_ERR(srq);		goto err_up;	}	srq->device    	   = pd->device;	srq->pd        	   = pd;	srq->uobject       = &uobj->uobject;	srq->event_handler = attr.event_handler;	srq->srq_context   = attr.srq_context;	atomic_inc(&pd->usecnt);	atomic_set(&srq->usecnt, 0);	memset(&resp, 0, sizeof resp);retry:	if (!idr_pre_get(&ib_uverbs_srq_idr, GFP_KERNEL)) {		ret = -ENOMEM;		goto err_destroy;	}	ret = idr_get_new(&ib_uverbs_srq_idr, srq, &uobj->uobject.id);	if (ret == -EAGAIN)		goto retry;	if (ret)		goto err_destroy;	resp.srq_handle = uobj->uobject.id;	spin_lock_irq(&file->ucontext->lock);	list_add_tail(&uobj->uobject.list, &file->ucontext->srq_list);	spin_unlock_irq(&file->ucontext->lock);	if (copy_to_user((void __user *) (unsigned long) cmd.response,			 &resp, sizeof resp)) {		ret = -EFAULT;		goto err_list;	}	up(&ib_uverbs_idr_mutex);	return in_len;err_list:	spin_lock_irq(&file->ucontext->lock);	list_del(&uobj->uobject.list);	spin_unlock_irq(&file->ucontext->lock);err_destroy:	ib_destroy_srq(srq);err_up:	up(&ib_uverbs_idr_mutex);	kfree(uobj);	return ret;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/63c47c286d062d93e0501d60797274c84a587e97/uverbs_cmd.c/buggy/drivers/infiniband/core/uverbs_cmd.c