down(&ib_uverbs_idr_mutex); idr_remove(&ib_uverbs_pd_idr, uobj->id); 
err_up: 
ssize_t ib_uverbs_alloc_pd(struct ib_uverbs_file *file,			   const char __user *buf,			   int in_len, int out_len){	struct ib_uverbs_alloc_pd      cmd;	struct ib_uverbs_alloc_pd_resp resp;	struct ib_udata                udata;	struct ib_uobject             *uobj;	struct ib_pd                  *pd;	int                            ret;	if (out_len < sizeof resp)		return -ENOSPC;	if (copy_from_user(&cmd, buf, sizeof cmd))		return -EFAULT;	INIT_UDATA(&udata, buf + sizeof cmd,		   (unsigned long) cmd.response + sizeof resp,		   in_len - sizeof cmd, out_len - sizeof resp);	uobj = kmalloc(sizeof *uobj, GFP_KERNEL);	if (!uobj)		return -ENOMEM;	uobj->context = file->ucontext;	pd = file->device->ib_dev->alloc_pd(file->device->ib_dev,					    file->ucontext, &udata);	if (IS_ERR(pd)) {		ret = PTR_ERR(pd);		goto err;	}	pd->device  = file->device->ib_dev;	pd->uobject = uobj;	atomic_set(&pd->usecnt, 0);retry:	if (!idr_pre_get(&ib_uverbs_pd_idr, GFP_KERNEL)) {		ret = -ENOMEM;		goto err_pd;	}	down(&ib_uverbs_idr_mutex);	ret = idr_get_new(&ib_uverbs_pd_idr, pd, &uobj->id);	up(&ib_uverbs_idr_mutex);	if (ret == -EAGAIN)		goto retry;	if (ret)		goto err_pd;	down(&file->mutex);	list_add_tail(&uobj->list, &file->ucontext->pd_list);	up(&file->mutex);	memset(&resp, 0, sizeof resp);	resp.pd_handle = uobj->id;	if (copy_to_user((void __user *) (unsigned long) cmd.response,			 &resp, sizeof resp)) {		ret = -EFAULT;		goto err_list;	}	return in_len;err_list: 	down(&file->mutex);	list_del(&uobj->list);	up(&file->mutex);	down(&ib_uverbs_idr_mutex);	idr_remove(&ib_uverbs_pd_idr, uobj->id);	up(&ib_uverbs_idr_mutex);err_pd:	ib_dealloc_pd(pd);err:	kfree(uobj);	return ret;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/eb9d3cd5ce2828fbb99ed7270089ea152c8f64b3/uverbs_cmd.c/buggy/drivers/infiniband/core/uverbs_cmd.c