IB/uverbs: Fix NULL pointer dereference during device removal

[karo-tx-linux.git] / drivers / infiniband / core / uverbs_main.c

diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 3d2609608f589625d0077167fa2e66a00430b89f..5e530d2bee4448ddcb68724199a5c93d36eec32a 100644 (file)
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -250,6 +250,7 @@ void ib_uverbs_release_file(struct kref *ref)
        if (atomic_dec_and_test(&file->device->refcount))
                ib_uverbs_comp_dev(file->device);
 
+       kobject_put(&file->device->kobj);
        kfree(file);
 }
 
@@ -917,7 +918,6 @@ err:
 static int ib_uverbs_close(struct inode *inode, struct file *filp)
 {
        struct ib_uverbs_file *file = filp->private_data;
-       struct ib_uverbs_device *dev = file->device;
 
        mutex_lock(&file->cleanup_mutex);
        if (file->ucontext) {
@@ -939,7 +939,6 @@ static int ib_uverbs_close(struct inode *inode, struct file *filp)
                         ib_uverbs_release_async_event_file);
 
        kref_put(&file->ref, ib_uverbs_release_file);
-       kobject_put(&dev->kobj);
 
        return 0;
 }
@@ -1154,7 +1153,6 @@ static void ib_uverbs_free_hw_resources(struct ib_uverbs_device *uverbs_dev,
                kref_get(&file->ref);
                mutex_unlock(&uverbs_dev->lists_mutex);
 
-               ib_uverbs_event_handler(&file->event_handler, &event);
 
                mutex_lock(&file->cleanup_mutex);
                ucontext = file->ucontext;
@@ -1171,6 +1169,7 @@ static void ib_uverbs_free_hw_resources(struct ib_uverbs_device *uverbs_dev,
                         * for example due to freeing the resources
                         * (e.g mmput).
                         */
+                       ib_uverbs_event_handler(&file->event_handler, &event);
                        ib_dev->disassociate_ucontext(ucontext);
                        mutex_lock(&file->cleanup_mutex);
                        ib_uverbs_cleanup_ucontext(file, ucontext, true);