The branch main has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=a7298669cd53a9fc8446c53db6872bc2f64c508d
commit a7298669cd53a9fc8446c53db6872bc2f64c508d Author: Ariel Ehrenberg <[email protected]> AuthorDate: 2026-06-08 10:56:16 +0000 Commit: Konstantin Belousov <[email protected]> CommitDate: 2026-07-07 11:25:23 +0000 ofed/ib_uverbs: release rdma_user_mmap entry ref in rdma_umap_close() Import Linux upstream commit 3411f9f01b76bd88aa6e0e013847ab6479cb4f24. rdma_umap_priv_init() takes a reference on the rdma_user_mmap entry for every VMA it maps, but rdma_umap_close() never dropped it. The entry was therefore never freed and lingered in ucontext->mmap_xa, tripping WARN_ON(!xa_empty(&ucontext->mmap_xa)) at context teardown and leaking the firmware UAR on every context close. Reviewed by: kib Tested by: Wafa Hamzah <[email protected]> Sponsored by: Nvidia networking MFC after: 1 month --- sys/ofed/drivers/infiniband/core/ib_uverbs_main.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sys/ofed/drivers/infiniband/core/ib_uverbs_main.c b/sys/ofed/drivers/infiniband/core/ib_uverbs_main.c index 1586c23d28d4..42b6d55de56e 100644 --- a/sys/ofed/drivers/infiniband/core/ib_uverbs_main.c +++ b/sys/ofed/drivers/infiniband/core/ib_uverbs_main.c @@ -745,6 +745,8 @@ static void rdma_umap_close(struct vm_area_struct *vma) * this point. */ mutex_lock(&ufile->umap_lock); + if (priv->entry) + rdma_user_mmap_entry_put(priv->entry); list_del(&priv->list); mutex_unlock(&ufile->umap_lock);
