Re: [PATCH] net/rds: drop the device reference for ODP memory regions

[Allison Henderson <achender@kernel.org>]

On Wed, 2026-11-04 at 02:28 +0000, Wentao Liang wrote:
> rds_ib_get_mr() takes a reference on the rds_ib_device with
> rds_ib_get_device().  The FRMR path stores it in ibmr->device and
> rds_ib_free_mr() drops it when the MR is freed.
> 
> The ODP path allocates the ibmr with kzalloc_obj() and returns it
> without recording the device.  rds_ib_odp_mr_worker() only deregisters
> the MR and frees the ibmr, so the reference taken for every ODP MR is
> never dropped and the rds_ib_device can no longer be released.
> 
> Store the reference in ibmr->device and drop it in the worker after
> the MR has been deregistered, which also keeps the device and its PD
> alive for as long as the MR exists.
> 
> Fixes: 2eafa1746f17 ("net/rds: Handle ODP mr registration/unregistration")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Hi Wentao,

Thanks for the patch.  The fix itself looks reasonable, but few things to update: since
this is a bug fix, it should should target net with [PATCH net v2]. The commit message
should mention how this was found, and whether it was tested. Reproducing this needs an
ODP-capable device, so if it was only build-tested, please say so. It looks like there's
a few check patch nits to work through as well:
https://patchwork.kernel.org/project/netdevbpf/patch/20261104022810.1484182-1-vulab@iscas.ac.cn/

Other than that it looks straight forward to me.

Thanks,
Allison

> ---
>  net/rds/ib_rdma.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
> index db7e92e7bd29..8cd8295f66a3 100644
> --- a/net/rds/ib_rdma.c
> +++ b/net/rds/ib_rdma.c
> @@ -591,6 +591,7 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
>  		}
>  		ibmr->u.mr = ib_mr;
>  		ibmr->odp = 1;
> +		ibmr->device = rds_ibdev;
>  
>  		sge.addr = virt_addr;
>  		sge.length = length;
> @@ -697,5 +698,6 @@ static void rds_ib_odp_mr_worker(struct work_struct  *work)
>  
>  	ibmr = container_of(work, struct rds_ib_mr, work.work);
>  	ib_dereg_mr(ibmr->u.mr);
> +	rds_ib_dev_put(ibmr->device);
>  	kfree(ibmr);
>  }