crash solved! (was: [openib-general] kernel crashes while using mvapich-gen2 over ib_uverbs)

[Roland Dreier]

I finally got to the bottom of this.  It's a pretty simple
use-after-free bug.  I didn't see it because the only machines I
routinely test CONFIG_DEBUG_SLAB=y kernels on are i386 machines, and
the implementation of dma_unmap_sg() for i386 doesn't expose this
bug.  As soon as I tested CONFIG_DEBUG_SLAB=y on x86_64, I saw the
same failure.  The patch below should fix this for you.

Please let me know if you still have problems after applying this patch.

Thanks,
  Roland

diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -130,13 +130,14 @@ static int ib_dealloc_ucontext(struct ib
 
 	list_for_each_entry_safe(uobj, tmp, &context->mr_list, list) {
 		struct ib_mr *mr = idr_find(&ib_uverbs_mr_idr, uobj->id);
+		struct ib_device *mrdev = mr->device;
 		struct ib_umem_object *memobj;
 
 		idr_remove(&ib_uverbs_mr_idr, uobj->id);
 		ib_dereg_mr(mr);
 
 		memobj = container_of(uobj, struct ib_umem_object, uobject);
-		ib_umem_release_on_close(mr->device, &memobj->umem);
+		ib_umem_release_on_close(mrdev, &memobj->umem);
 
 		list_del(&uobj->list);
 		kfree(memobj);