Fix two lifetime bugs in the uverbs DMABUF export path. Patch 1 fixes leaked uobject and ufile references when the uverbs FD is closed first. Patch 2 fixes a use-after-free when dma-buf release races with ufile cleanup.
Tested on mainline 4056b3c9d3c9 in x86_64 QEMU with KASAN and lockdep, using test-only siw export hooks. The unpatched kernel reproduces both bugs. Patch 1 fixes the leak, confirmed by tracing ufile release. With both patches, the same tests complete without KASAN or lockdep reports. The tests cover core export and teardown, not real mlx5 hardware, importer DMA mappings, device removal, or allocation abort. The abort issue in patch 1 is based on source review. Testing on mlx5 would be helpful. Deep Shah (2): RDMA/uverbs: Fix uobject leak in DMABUF release RDMA/uverbs: Fix DMABUF use-after-free during ufile cleanup drivers/infiniband/core/ib_core_uverbs.c | 10 +--- drivers/infiniband/core/uverbs.h | 37 +++++++++++++++ .../infiniband/core/uverbs_std_types_dmabuf.c | 46 +++++++++++-------- 3 files changed, 66 insertions(+), 27 deletions(-) base-commit: 72d3fcf802c45d00b300f25b848a93c3a2bd7c7e
