spin_lock_irq(&file->ucontext->lock); 
down(&file->mutex); 
ssize_t ib_uverbs_dealloc_pd(struct ib_uverbs_file *file,			     const char __user *buf,			     int in_len, int out_len){	struct ib_uverbs_dealloc_pd cmd;	struct ib_pd               *pd;	struct ib_uobject          *uobj;	int                         ret = -EINVAL;	if (copy_from_user(&cmd, buf, sizeof cmd))		return -EFAULT;	down(&ib_uverbs_idr_mutex);	pd = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);	if (!pd || pd->uobject->context != file->ucontext)		goto out;	uobj = pd->uobject;	ret = ib_dealloc_pd(pd);	if (ret)		goto out;	idr_remove(&ib_uverbs_pd_idr, cmd.pd_handle);	spin_lock_irq(&file->ucontext->lock);	list_del(&uobj->list);	spin_unlock_irq(&file->ucontext->lock);	kfree(uobj);out:	up(&ib_uverbs_idr_mutex);	return ret ? ret : in_len;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/63c47c286d062d93e0501d60797274c84a587e97/uverbs_cmd.c/buggy/drivers/infiniband/core/uverbs_cmd.c