IB/mad: Fix kernel crash when .process_mad() returns SUCCESS|CONSUMED

[safe/jmp/linux-2.6] / drivers / infiniband / core / uverbs.h

diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
index bb9bee5..376a57c 100644 (file)
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -42,8 +42,10 @@
 #include <linux/kref.h>
 #include <linux/idr.h>
 #include <linux/mutex.h>
+#include <linux/completion.h>
 
 #include <rdma/ib_verbs.h>
+#include <rdma/ib_umem.h>
 #include <rdma/ib_user_verbs.h>
 
 /*
@@ -69,22 +71,23 @@
 
 struct ib_uverbs_device {
        struct kref                             ref;
+       struct completion                       comp;
        int                                     devnum;
-       struct cdev                            *dev;
-       struct class_device                    *class_dev;
+       struct cdev                            *cdev;
+       struct device                          *dev;
        struct ib_device                       *ib_dev;
        int                                     num_comp_vectors;
 };
 
 struct ib_uverbs_event_file {
        struct kref                             ref;
-       struct file                            *file;
        struct ib_uverbs_file                  *uverbs_file;
        spinlock_t                              lock;
-       int                                     is_async;
        wait_queue_head_t                       poll_wait;
        struct fasync_struct                   *async_queue;
        struct list_head                        event_list;
+       int                                     is_async;
+       int                                     is_closed;
 };
 
 struct ib_uverbs_file {
@@ -145,7 +148,6 @@ void idr_remove_uobj(struct idr *idp, struct ib_uobject *uobj);
 
 struct file *ib_uverbs_alloc_event_file(struct ib_uverbs_file *uverbs_file,
                                        int is_async, int *fd);
-void ib_uverbs_release_event_file(struct kref *ref);
 struct ib_uverbs_event_file *ib_uverbs_lookup_comp_file(int fd);
 
 void ib_uverbs_release_ucq(struct ib_uverbs_file *file,
@@ -161,11 +163,6 @@ void ib_uverbs_srq_event_handler(struct ib_event *event, void *context_ptr);
 void ib_uverbs_event_handler(struct ib_event_handler *handler,
                             struct ib_event *event);
 
-int ib_umem_get(struct ib_device *dev, struct ib_umem *mem,
-               void *addr, size_t size, int write);
-void ib_umem_release(struct ib_device *dev, struct ib_umem *umem);
-void ib_umem_release_on_close(struct ib_device *dev, struct ib_umem *umem);
-
 #define IB_UVERBS_DECLARE_CMD(name)                                    \
        ssize_t ib_uverbs_##name(struct ib_uverbs_file *file,           \
                                 const char __user *buf, int in_len,    \