IB/ipath: Don't corrupt pending mmap list when unmapped objects are freed

Fix the pending mmap code so it doesn't corrupt the list of pending
mmaps and crash the machine when pending mmaps are destroyed without
first being mapped.  Also, remove an unused variable, and use standard
kernel lists instead of our own homebrewed linked list implementation
to keep the pending mmap list.

Signed-off-by: Robert Walsh <robert.walsh@qlogic.com>
Signed-off-by: Ralph Campbell <ralph.campbell@qlogic.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

1 files changed, 3 insertions, 0 deletions

diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.c b/drivers/infiniband/hw/ipath/ipath_verbs.c
index 18c6df2052c2..b676ea81fc41 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs.c
+++ b/drivers/infiniband/hw/ipath/ipath_verbs.c
@@ -1476,7 +1476,10 @@ int ipath_register_ib_device(struct ipath_devdata *dd)
                 ret = -ENOMEM;
                 goto err_lk;
         }
+        INIT_LIST_HEAD(&idev->pending_mmaps);
         spin_lock_init(&idev->pending_lock);
+        idev->mmap_offset = PAGE_SIZE;
+        spin_lock_init(&idev->mmap_offset_lock);
         INIT_LIST_HEAD(&idev->pending[0]);
         INIT_LIST_HEAD(&idev->pending[1]);
         INIT_LIST_HEAD(&idev->pending[2]);