1 files changed, 15 insertions, 6 deletions

diff --git a/drivers/infiniband/core/fmr_pool.c b/drivers/infiniband/core/fmr_pool.c
index 4a476a870214..6c7aa59794d4 100644
--- a/drivers/infiniband/core/fmr_pool.c
+++ b/drivers/infiniband/core/fmr_pool.c
@@ -139,7 +139,7 @@ static inline struct ib_pool_fmr *ib_fmr_cache_lookup(struct ib_fmr_pool *pool,
 static void ib_fmr_batch_release(struct ib_fmr_pool *pool)
 {
         int                 ret;
-        struct ib_pool_fmr *fmr;
+        struct ib_pool_fmr *fmr, *next;
         LIST_HEAD(unmap_list);
         LIST_HEAD(fmr_list);
 
@@ -158,6 +158,20 @@ static void ib_fmr_batch_release(struct ib_fmr_pool *pool)
 #endif
         }
 
+        /*
+         * The free_list may hold FMRs that have been put there
+         * because they haven't reached the max_remap count.
+         * Invalidate their mapping as well.
+         */
+        list_for_each_entry_safe(fmr, next, &pool->free_list, list) {
+                if (fmr->remap_count == 0)
+                        continue;
+                hlist_del_init(&fmr->cache_node);
+                fmr->remap_count = 0;
+                list_add_tail(&fmr->fmr->list, &fmr_list);
+                list_move(&fmr->list, &unmap_list);
+        }
+
         list_splice(&pool->dirty_list, &unmap_list);
         INIT_LIST_HEAD(&pool->dirty_list);
         pool->dirty_len = 0;
@@ -367,11 +381,6 @@ void ib_destroy_fmr_pool(struct ib_fmr_pool *pool)
 
         i = 0;
         list_for_each_entry_safe(fmr, tmp, &pool->free_list, list) {
-                if (fmr->remap_count) {
-                        INIT_LIST_HEAD(&fmr_list);
-                        list_add_tail(&fmr->fmr->list, &fmr_list);
-                        ib_unmap_fmr(&fmr_list);
-                }
                 ib_dealloc_fmr(fmr->fmr);
                 list_del(&fmr->list);
                 kfree(fmr);