diff options
| author | Ariel Ehrenberg <aehrenberg@nvidia.com> | 2026-06-08 10:56:16 +0000 |
|---|---|---|
| committer | Konstantin Belousov <kib@FreeBSD.org> | 2026-07-07 11:25:23 +0000 |
| commit | a7298669cd53a9fc8446c53db6872bc2f64c508d (patch) | |
| tree | bc7f460e704014a0843de89408ecf3053a0dcd59 | |
| parent | 80902b8b7cd409ade11048dc78212e7d43475c65 (diff) | |
ofed/ib_uverbs: release rdma_user_mmap entry ref in rdma_umap_close()
Import Linux upstream commit 3411f9f01b76bd88aa6e0e013847ab6479cb4f24.
rdma_umap_priv_init() takes a reference on the rdma_user_mmap entry for
every VMA it maps, but rdma_umap_close() never dropped it. The entry
was therefore never freed and lingered in ucontext->mmap_xa, tripping
WARN_ON(!xa_empty(&ucontext->mmap_xa)) at context teardown and leaking
the firmware UAR on every context close.
Reviewed by: kib
Tested by: Wafa Hamzah <wafah@nvidia.com>
Sponsored by: Nvidia networking
MFC after: 1 month
| -rw-r--r-- | sys/ofed/drivers/infiniband/core/ib_uverbs_main.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/sys/ofed/drivers/infiniband/core/ib_uverbs_main.c b/sys/ofed/drivers/infiniband/core/ib_uverbs_main.c index 1586c23d28d4..42b6d55de56e 100644 --- a/sys/ofed/drivers/infiniband/core/ib_uverbs_main.c +++ b/sys/ofed/drivers/infiniband/core/ib_uverbs_main.c @@ -745,6 +745,8 @@ static void rdma_umap_close(struct vm_area_struct *vma) * this point. */ mutex_lock(&ufile->umap_lock); + if (priv->entry) + rdma_user_mmap_entry_put(priv->entry); list_del(&priv->list); mutex_unlock(&ufile->umap_lock); |