xprt_setup_rdma_bc() takes two references on the new rpc_xprt: one for the xpt_bc_xprt link, which svc_xprt_free() drops, and a second one whose final put used to live in __svc_rdma_free(). That put was removed when svc_xprt_free() took over releasing the backchannel transport, but svc_xprt_free() only drops the reference belonging to the xpt_bc_xprt link. The second reference is therefore never released: the rpc_xprt outlives the callback client and the connection, and the net namespace reference taken by xprt_alloc() is leaked with it. Keep only the reference that svc_xprt_free() releases, the same way the TCP backchannel transport does, and drop the comment pointing at the function that no longer performs the put. Fixes: 729580ddc53e ("svcrdma: xpt_bc_xprt is already clear in __svc_rdma_free()") Cc: stable@vger.kernel.org Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex Signed-off-by: Wentao Liang --- net/sunrpc/xprtrdma/svc_rdma_backchannel.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c index e5a78b761012..6a504806165c 100644 --- a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c +++ b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c @@ -269,9 +269,6 @@ xprt_setup_rdma_bc(struct xprt_create *args) xprt_get(xprt); args->bc_xprt->xpt_bc_xprt = xprt; xprt->bc_xprt = args->bc_xprt; - - /* Final put for backchannel xprt is in __svc_rdma_free */ - xprt_get(xprt); return xprt; } -- 2.34.1