From 06541a4931e456e9b1d669649857e47686bc5a01 Mon Sep 17 00:00:00 2001
From: dujunbao <14829755+du-junbao@user.noreply.gitee.com>
Date: Tue, 22 Sep 2026 21:58:28 +0800
Subject: [PATCH] ub: ubmad: release the tjetty reference on the response
 repost error paths

ubmad_try_repost_all_response() takes a reference on the target jetty and
releases it on the paths that fail after the retransmission buffer was
matched, but the failures before the work request is built, and the
repost_resp_put_id label used by the tx_in_queue threshold and by a
failed ubcore_post_jetty_send_wr(), return without it:

	- ubmad_find_and_create_tgt_hash_node() failing,
	- failing to get an sge id,
	- the label above.

Each of them leaks one reference per attempt, so the tjetty of a peer
that keeps retransmitting conn requests can never reach refcount zero and
its resources are never released. All of them run before a work request
is posted, so nothing else owns the reference yet. The sibling
ubmad_repost_send_conn_data() releases the tjetty on the equivalent label
before it puts the sge id; do the same here.

Fixes: 0d931bb2453a ("urma: add software reliability for create and destroy connection")
---
 drivers/ub/urma/ubcore/ubcm/ubmad_datapath.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/drivers/ub/urma/ubcore/ubcm/ubmad_datapath.c b/drivers/ub/urma/ubcore/ubcm/ubmad_datapath.c
index 08e8d9936564..b2329bb17dd9 100644
--- a/drivers/ub/urma/ubcore/ubcm/ubmad_datapath.c
+++ b/drivers/ub/urma/ubcore/ubcm/ubmad_datapath.c
@@ -312,8 +312,10 @@ static int ubmad_try_repost_all_response(
        struct ubmad_tgt_hash_node *hash_node = ubmad_find_and_create_tgt_hash_node(
 		       tjetty, msn, &hash_flag);
 
-       if (IS_ERR_OR_NULL(hash_node))
-	       return -1;
+	if (IS_ERR_OR_NULL(hash_node)) {
+		ubmad_put_tjetty(tjetty);
+		return -1;
+	}
 
        if (hash_flag == 1) {
 	       ubmad_put_tjetty(tjetty);
@@ -340,7 +342,8 @@ static int ubmad_try_repost_all_response(
        sge_idx = ubmad_bitmap_get_id(rsrc->send_seg_bitmap);
        if (sge_idx >= rsrc->send_seg_bitmap->size) {
 	       ubcore_log_err("get sge_idx failed\n");
-	       return -1;
+		ubmad_put_tjetty(tjetty);
+		return -1;
        }
        sge_addr = rsrc->send_seg->seg.ubva.va + UBMAD_SGE_MAX_LEN * sge_idx;
 
@@ -376,8 +379,9 @@ static int ubmad_try_repost_all_response(
        return 0;
 
 repost_resp_put_id:
-       (void)ubmad_bitmap_put_id(rsrc->send_seg_bitmap, sge_idx);
-       return -1;
+	ubmad_put_tjetty(tjetty);
+	(void)ubmad_bitmap_put_id(rsrc->send_seg_bitmap, sge_idx);
+	return -1;
 }
 
 /* retransmission work */
-- 
Gitee