From 89f5575786858740ad74066393ad923076395849 Mon Sep 17 00:00:00 2001
From: dujunbao <14829755+du-junbao@user.noreply.gitee.com>
Date: Tue, 22 Sep 2026 21:59:41 +0800
Subject: [PATCH] ub: ubmgr: free the ping response context when the reply
 cannot be posted

ping_wq_on_recved() allocates a ubmgr_ping_resp_ctx for the reply, stores
it in the work request through wr.user_ctx, and hands the request to
ubcore_post_jetty_send_wr(). The context is normally released by
ping_wq_on_sended(), which reads it back from the completion.

When the post fails, the request is rejected and the completion never
runs, but the error path only drops the tjetty reference and returns to
the refill label, leaving the context allocated. Every rejected reply
leaks one ubmgr_ping_resp_ctx.

Free it on that path; the request was not accepted, so the completion
cannot touch it.

Fixes: a0c181574231 ("urma: add ping server")
---
 drivers/ub/urma/ubcore/ubmgr/ubmgr_ping.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/ub/urma/ubcore/ubmgr/ubmgr_ping.c b/drivers/ub/urma/ubcore/ubmgr/ubmgr_ping.c
index a8a83c229e74..76827acd2bec 100644
--- a/drivers/ub/urma/ubcore/ubmgr/ubmgr_ping.c
+++ b/drivers/ub/urma/ubcore/ubmgr/ubmgr_ping.c
@@ -289,6 +289,7 @@ static void ping_wq_on_recved(struct ubmgr_ping_ctx *ctx, struct ubcore_cr *cr)
 	ret = ubcore_post_jetty_send_wr(ctx->jetty, &wr, &bad_wr);
 	if (ret != 0) {
 		ping_tjetty_put(ctx, entry);
+		kfree(resp_ctx);
 		ubcore_log_err("Fail to post send wr, ret:%d\n", ret);
 		goto refill;
 	}
-- 
Gitee