git: a7298669cd53 - main - ofed/ib_uverbs: release rdma_user_mmap entry ref in rdma_umap_close()

The branch main has been updated by kib:

URL: https://cgit.FreeBSD.org/src/commit/?id=a7298669cd53a9fc8446c53db6872bc2f64c508d

commit a7298669cd53a9fc8446c53db6872bc2f64c508d
Author:     Ariel Ehrenberg <aehrenberg@nvidia.com>
AuthorDate: 2026-06-08 10:56:16 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2026-07-07 11:25:23 +0000

    ofed/ib_uverbs: release rdma_user_mmap entry ref in rdma_umap_close()
    
    Import Linux upstream commit 3411f9f01b76bd88aa6e0e013847ab6479cb4f24.
    
    rdma_umap_priv_init() takes a reference on the rdma_user_mmap entry for
    every VMA it maps, but rdma_umap_close() never dropped it.  The entry
    was therefore never freed and lingered in ucontext->mmap_xa, tripping
    WARN_ON(!xa_empty(&ucontext->mmap_xa)) at context teardown and leaking
    the firmware UAR on every context close.
    
    Reviewed by:    kib
    Tested by:      Wafa Hamzah <wafah@nvidia.com>
    Sponsored by:   Nvidia networking
    MFC after:      1 month
---
 sys/ofed/drivers/infiniband/core/ib_uverbs_main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sys/ofed/drivers/infiniband/core/ib_uverbs_main.c b/sys/ofed/drivers/infiniband/core/ib_uverbs_main.c
index 1586c23d28d4..42b6d55de56e 100644
--- a/sys/ofed/drivers/infiniband/core/ib_uverbs_main.c
+++ b/sys/ofed/drivers/infiniband/core/ib_uverbs_main.c
@@ -745,6 +745,8 @@ static void rdma_umap_close(struct vm_area_struct *vma)
 	 * this point.
 	 */
 	mutex_lock(&ufile->umap_lock);
+	if (priv->entry)
+		rdma_user_mmap_entry_put(priv->entry);
 
 	list_del(&priv->list);
 	mutex_unlock(&ufile->umap_lock);