[PATCH] net/rds: drop the device reference for ODP memory regions

[PATCH] net/rds: drop the device reference for ODP memory regions

[Wentao Liang]

rds_ib_get_mr() takes a reference on the rds_ib_device with
rds_ib_get_device().  The FRMR path stores it in ibmr->device and
rds_ib_free_mr() drops it when the MR is freed.

The ODP path allocates the ibmr with kzalloc_obj() and returns it
without recording the device.  rds_ib_odp_mr_worker() only deregisters
the MR and frees the ibmr, so the reference taken for every ODP MR is
never dropped and the rds_ib_device can no longer be released.

Store the reference in ibmr->device and drop it in the worker after
the MR has been deregistered, which also keeps the device and its PD
alive for as long as the MR exists.

Fixes: 2eafa1746f17 ("net/rds: Handle ODP mr registration/unregistration")
Cc: stable@vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 net/rds/ib_rdma.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
index db7e92e7bd29..8cd8295f66a3 100644
--- a/net/rds/ib_rdma.c
+++ b/net/rds/ib_rdma.c
@@ -591,6 +591,7 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
 		}
 		ibmr->u.mr = ib_mr;
 		ibmr->odp = 1;
+		ibmr->device = rds_ibdev;
 
 		sge.addr = virt_addr;
 		sge.length = length;
@@ -697,5 +698,6 @@ static void rds_ib_odp_mr_worker(struct work_struct  *work)
 
 	ibmr = container_of(work, struct rds_ib_mr, work.work);
 	ib_dereg_mr(ibmr->u.mr);
+	rds_ib_dev_put(ibmr->device);
 	kfree(ibmr);
 }
-- 
2.34.1

Re: [PATCH] net/rds: drop the device reference for ODP memory regions

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH] net/rds: drop the device reference for ODP memory regions

[Krzysztof Kozlowski]

On Wed, 04 Nov 2026 02:28:10 +0000, Wentao Liang wrote:
> rds_ib_get_mr() takes a reference on the rds_ib_device with
> rds_ib_get_device().  The FRMR path stores it in ibmr->device and
> rds_ib_free_mr() drops it when the MR is freed.
> 
> The ODP path allocates the ibmr with kzalloc_obj() and returns it
> without recording the device.  rds_ib_odp_mr_worker() only deregisters
> the MR and frees the ibmr, so the reference taken for every ODP MR is
> never dropped and the rds_ib_device can no longer be released.
> 
> Store the reference in ibmr->device and drop it in the worker after
> the MR has been deregistered, which also keeps the device and its PD
> alive for as long as the MR exists.
> 
> Fixes: 2eafa1746f17 ("net/rds: Handle ODP mr registration/unregistration")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  net/rds/ib_rdma.c | 2 ++
>  1 file changed, 2 insertions(+)
> 

Multiple things here:
1. Your team ignored completely previous feedback. Multiple times.

2. You use multiple identities with this email address, thus I doubt that we
   speak with an actual person.

3. Your bot does not even bother running checkpatch, right?

4. Nothing of this was reproduced nor tested.

5. Finally, the same feedback:
You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem (so a patchset grouping multiple patches with a short cover
letter), how to document the issue discovery method and what was
or was not tested.

Best regards,
Krzysztof

Re: [PATCH] net/rds: drop the device reference for ODP memory regions

[Allison Henderson]

On Wed, 2026-11-04 at 02:28 +0000, Wentao Liang wrote:
> rds_ib_get_mr() takes a reference on the rds_ib_device with
> rds_ib_get_device().  The FRMR path stores it in ibmr->device and
> rds_ib_free_mr() drops it when the MR is freed.
> 
> The ODP path allocates the ibmr with kzalloc_obj() and returns it
> without recording the device.  rds_ib_odp_mr_worker() only deregisters
> the MR and frees the ibmr, so the reference taken for every ODP MR is
> never dropped and the rds_ib_device can no longer be released.
> 
> Store the reference in ibmr->device and drop it in the worker after
> the MR has been deregistered, which also keeps the device and its PD
> alive for as long as the MR exists.
> 
> Fixes: 2eafa1746f17 ("net/rds: Handle ODP mr registration/unregistration")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Hi Wentao,

Thanks for the patch.  The fix itself looks reasonable, but few things to update: since
this is a bug fix, it should should target net with [PATCH net v2]. The commit message
should mention how this was found, and whether it was tested. Reproducing this needs an
ODP-capable device, so if it was only build-tested, please say so. It looks like there's
a few check patch nits to work through as well:
https://patchwork.kernel.org/project/netdevbpf/patch/20261104022810.1484182-1-vulab@iscas.ac.cn/

Other than that it looks straight forward to me.

Thanks,
Allison

> ---
>  net/rds/ib_rdma.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
> index db7e92e7bd29..8cd8295f66a3 100644
> --- a/net/rds/ib_rdma.c
> +++ b/net/rds/ib_rdma.c
> @@ -591,6 +591,7 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
>  		}
>  		ibmr->u.mr = ib_mr;
>  		ibmr->odp = 1;
> +		ibmr->device = rds_ibdev;
>  
>  		sge.addr = virt_addr;
>  		sge.length = length;
> @@ -697,5 +698,6 @@ static void rds_ib_odp_mr_worker(struct work_struct  *work)
>  
>  	ibmr = container_of(work, struct rds_ib_mr, work.work);
>  	ib_dereg_mr(ibmr->u.mr);
> +	rds_ib_dev_put(ibmr->device);
>  	kfree(ibmr);
>  }

Re: [PATCH] net/rds: drop the device reference for ODP memory regions

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] net/rds: rds_ib_odp_mr_worker() queues rds_ib_dev_free() after rds_wq flush
--

commit 867b786572304fe8059ffdca78162ac460e2ac8e
Author: Wentao Liang <vulab@iscas.ac.cn>

net/rds: drop the device reference for ODP memory regions

This patch stores the rds_ib_device reference in ibmr->device when registering
an ODP memory region in rds_ib_get_mr() and drops it in rds_ib_odp_mr_worker()
after deregistering the MR.

> diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
> index db7e92e7bd29f..8cd8295f66a39 100644
> --- a/net/rds/ib_rdma.c
> +++ b/net/rds/ib_rdma.c
> @@ -591,6 +591,7 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
>  		}
>  		ibmr->u.mr = ib_mr;
>  		ibmr->odp = 1;
> +		ibmr->device = rds_ibdev;
>  
>  		sge.addr = virt_addr;
>  		sge.length = length;
> @@ -697,5 +698,6 @@ static void rds_ib_odp_mr_worker(struct work_struct  *work)
>  
>  	ibmr = container_of(work, struct rds_ib_mr, work.work);
>  	ib_dereg_mr(ibmr->u.mr);
> +	rds_ib_dev_put(ibmr->device);

[Severity: High]
Could dropping ibmr->device from rds_ib_odp_mr_worker() on rds_ib_mr_wq cause
rds_ib_dev_free() to be queued onto rds_wq after rds_ib_unregister_client()
has already flushed rds_wq during module unload?

Unlike FRMRs, which call rds_ib_dev_put() synchronously in rds_ib_free_mr(),
ODP MRs defer teardown to rds_ib_mr_wq:

net/rds/ib_rdma.c:rds_ib_free_mr() {
	if (ibmr->odp) {
		INIT_DELAYED_WORK(&ibmr->work, rds_ib_odp_mr_worker);
		queue_delayed_work(rds_ib_mr_wq, &ibmr->work, 0);
		return;
	}
}

When the last RDS socket closes via rds_release() -> rds_rdma_drop_keys() ->
rds_ib_free_mr() (or rds_send_drop_to() -> rds_rdma_free_op() ->
rds_ib_free_mr()), rds_ib_flush_mrs() only flushes mr_8k_pool and mr_1m_pool
without flushing rds_ib_mr_wq before rds_release() drops the transport module
reference.

If the rds_rdma module is then unloaded, rds_ib_exit() runs
rds_ib_unregister_client() before rds_ib_mr_exit():

net/rds/ib.c:rds_ib_unregister_client() {
	ib_unregister_client(&rds_ib_client);
	/* wait for rds_ib_dev_free() to complete */
	flush_workqueue(rds_wq);
}

net/rds/ib.c:rds_ib_exit() {
	...
	rds_ib_unregister_client();
	rds_ib_destroy_nodev_conns();
	rds_ib_sysctl_exit();
	rds_ib_recv_exit();
	rds_trans_unregister(&rds_ib_transport);
	rds_ib_mr_exit();
}

If rds_ib_odp_mr_worker() is still pending on rds_ib_mr_wq when
rds_ib_unregister_client() runs, rds_ibdev->refcount will not drop to zero in
rds_ib_remove_one(), so rds_ibdev->free_work is not queued yet when
flush_workqueue(rds_wq) returns.

Then, at the end of rds_ib_exit(), rds_ib_mr_exit() calls
destroy_workqueue(rds_ib_mr_wq), which drains rds_ib_odp_mr_worker() and calls
rds_ib_dev_put(ibmr->device):

net/rds/ib.c:rds_ib_dev_put() {
	BUG_ON(refcount_read(&rds_ibdev->refcount) == 0);
	if (refcount_dec_and_test(&rds_ibdev->refcount))
		queue_work(rds_wq, &rds_ibdev->free_work);
}

Wouldn't that queue rds_ibdev->free_work (rds_ib_dev_free) onto rds_wq right
as rds_ib_exit() returns, allowing rds_ib_dev_free() to execute after
rds_ib_mr_wq is destroyed, after ib_unregister_client() has completed, and
after the rds_rdma module is unmapped?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261104022810.1484182-1-vulab@iscas.ac.cn?part=1