rds_ib_get_mr() takes a reference on the rds_ib_device with rds_ib_get_device(). The FRMR path stores it in ibmr->device and rds_ib_free_mr() drops it when the MR is freed. The ODP path allocates the ibmr with kzalloc_obj() and returns it without recording the device. rds_ib_odp_mr_worker() only deregisters the MR and frees the ibmr, so the reference taken for every ODP MR is never dropped and the rds_ib_device can no longer be released. Store the reference in ibmr->device and drop it in the worker after the MR has been deregistered, which also keeps the device and its PD alive for as long as the MR exists. Fixes: 2eafa1746f17 ("net/rds: Handle ODP mr registration/unregistration") Cc: stable@vger.kernel.org Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex Signed-off-by: Wentao Liang --- net/rds/ib_rdma.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c index db7e92e7bd29..8cd8295f66a3 100644 --- a/net/rds/ib_rdma.c +++ b/net/rds/ib_rdma.c @@ -591,6 +591,7 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents, } ibmr->u.mr = ib_mr; ibmr->odp = 1; + ibmr->device = rds_ibdev; sge.addr = virt_addr; sge.length = length; @@ -697,5 +698,6 @@ static void rds_ib_odp_mr_worker(struct work_struct *work) ibmr = container_of(work, struct rds_ib_mr, work.work); ib_dereg_mr(ibmr->u.mr); + rds_ib_dev_put(ibmr->device); kfree(ibmr); } -- 2.34.1