Re: [PATCH rdma-next v6 7/9] RDMA/bnxt_re: Enhance dpi lifecycle logic in doorbell uapis

[Jason Gunthorpe <jgg@ziepe.ca>]

On Tue, May 19, 2026 at 06:50:38PM +0530, Sriharsha Basavapatna wrote:
> > > ufile_destroy_ucontext(reason == RDMA_REMOVE_DRIVER_REMOVE) -->
> > > uverbs_user_mmap_disassociate() --> rdma_user_mmap_entry_put() -->
> > > rdma_user_mmap_entry_free() --> ucontext->device->ops.mmap_free()
> >
> > Yes, that's right. The disassociate removes the references from all
> > the VMAs so it should always eventually call free.
> Ok, so disassociate() triggers mmap free in the driver while
> ib_ucontext is still valid, right?  The use-after-free concern raised
> above, where uctx has been freed, shouldn't occur?

As far as I can see. At least you would be in good company making this
assumption...

> > However, it would be best if we didn't have this code in the free
> > callback at all, ideally the destruction of the object will happen in
> > the uobject destructor not the mmap free. However, I think we lack the
> > ability to do that right now.
> >
> I had to move it into mmap_free() because a prior concern pointed out
> that the dpi could be reallocated to another process, while the
> original process's mmap is still active.  Although the bnxt_re library
> unmaps first and then destroys the dbr object (i.e in the right
> sequence), I still tried to address that concern by moving it into
> mmap free context.

Yes, we lack the ability to shoot down a single mmap_entry during the
uboject destruction so it has to work like this :(

Jason