When no source GID attribute is supplied, get_cm_port_from_path() looks one up with rdma_find_gid(). A successful lookup takes a reference even if the matching port has no CM port object. cm_add_one() skips ports without IB CM support, so cm_dev->port[] can contain NULL entries. The current cleanup tests port instead of the lookup result, leaking the GID attribute reference when a matching non-CM port is found. Test whether the attribute is valid before releasing it. Keep the put outside the CM device lock and skip it for a failed lookup or an empty device list. Fixes: 398391071f25 ("IB/cm: Replace members of sa_path_rec with 'struct sgid_attr *'") Cc: stable@vger.kernel.org Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex Signed-off-by: Wentao Liang --- drivers/infiniband/core/cm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c index 1a2c2775b14d..0d95cb27ad17 100644 --- a/drivers/infiniband/core/cm.c +++ b/drivers/infiniband/core/cm.c @@ -517,7 +517,7 @@ get_cm_port_from_path(struct sa_path_rec *path, const struct ib_gid_attr *attr) } } read_unlock_irqrestore(&cm.device_lock, flags); - if (port) + if (!IS_ERR_OR_NULL(attr)) rdma_put_gid_attr(attr); } return port; -- 2.34.1