[PATCH] IB: unmap FMRs when destroying FMR pool

Make sure that all FMRs are unmapped before we deallocate them so that
we don't leak references to our protection domain when destroying an
FMR pool.  (Bug reported by Guy German <guyg@voltaire.com>)

Signed-off-by: Roland Dreier <rolandd@cisco.com>

1 files changed, 6 insertions, 0 deletions

diff --git a/drivers/infiniband/core/fmr_pool.c b/drivers/infiniband/core/fmr_pool.c
index 7763b31abba7..1f7374927f38 100644
--- a/drivers/infiniband/core/fmr_pool.c
+++ b/drivers/infiniband/core/fmr_pool.c
@@ -334,6 +334,7 @@ void ib_destroy_fmr_pool(struct ib_fmr_pool *pool)
 {
         struct ib_pool_fmr *fmr;
         struct ib_pool_fmr *tmp;
+        LIST_HEAD(fmr_list);
         int                 i;
 
         kthread_stop(pool->thread);
@@ -341,6 +342,11 @@ void ib_destroy_fmr_pool(struct ib_fmr_pool *pool)
 
         i = 0;
         list_for_each_entry_safe(fmr, tmp, &pool->free_list, list) {
+                if (fmr->remap_count) {
+                        INIT_LIST_HEAD(&fmr_list);
+                        list_add_tail(&fmr->fmr->list, &fmr_list);
+                        ib_unmap_fmr(&fmr_list);
+                }
                 ib_dealloc_fmr(fmr->fmr);
                 list_del(&fmr->list);
                 kfree(fmr);