From 9cab68b01073910cd7e844627d2712220d4e49ea Mon Sep 17 00:00:00 2001
From: dujunbao <14829755+du-junbao@user.noreply.gitee.com>
Date: Tue, 22 Sep 2026 21:56:30 +0800
Subject: [PATCH] ub: ubmad: do not release a tjetty the retransmission work
 never found

ubmad_rt_work_handler() looks the target jetty up with
ubmad_get_tjetty(), tolerates a failed lookup when it releases the
initial retransmission buffer, and then drops the reference
unconditionally:

	if (!IS_ERR_OR_NULL(tjetty))
		ubmad_release_ini_rtbuffer(tjetty, rt_work->msn);
	...
	ubmad_put_tjetty(tjetty);

ubmad_get_tjetty() returns NULL when the peer's jetty is no longer in the
hash, which is normal for this delayed work: the tjetty can be removed by
a close request while the retransmission is queued. ubmad_put_tjetty()
dereferences its argument, so the NULL case faults in the workqueue
handler instead of finishing the work.

Guard the put with the same check the buffer release above uses.

Fixes: 0d931bb2453a ("urma: add software reliability for create and destroy connection")
---
 drivers/ub/urma/ubcore/ubcm/ubmad_datapath.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/ub/urma/ubcore/ubcm/ubmad_datapath.c b/drivers/ub/urma/ubcore/ubcm/ubmad_datapath.c
index 08e8d9936564..641c952571c2 100644
--- a/drivers/ub/urma/ubcore/ubcm/ubmad_datapath.c
+++ b/drivers/ub/urma/ubcore/ubcm/ubmad_datapath.c
@@ -431,7 +431,8 @@ static void ubmad_rt_work_handler(struct work_struct *work)
 	ubcore_log_info_rl("Do not repost, found: %u, rt_work->rt_cnt: %u.\n",
 		      (uint32_t)found, rt_work->rt_cnt);
 
-	ubmad_put_tjetty(tjetty);
+	if (!IS_ERR_OR_NULL(tjetty))
+		ubmad_put_tjetty(tjetty);
 	kfree(rt_work);
 }
 
-- 
Gitee