nldev_dellink() takes a reference on the ib_device with
ib_device_get_by_index().  When the driver's dellink callback fails,
the function returns the error directly without dropping that
reference, leaking it.  Call ib_device_put() on the dellink error
path before returning, matching the handling of the other error
exits in this function.

Fixes: a60e3f3d6fba ("RDMA/nldev: Add dellink function pointer")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/infiniband/core/nldev.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
index 5aaba2b9746b..e4a9562313fa 100644
--- a/drivers/infiniband/core/nldev.c
+++ b/drivers/infiniband/core/nldev.c
@@ -1850,8 +1850,10 @@ static int nldev_dellink(struct sk_buff *skb, struct nlmsghdr *nlh,
 		mutex_lock(&nldev_dellink_mutex);
 		err = device->link_ops->dellink(device);
 		mutex_unlock(&nldev_dellink_mutex);
-		if (err)
+		if (err) {
+			ib_device_put(device);
 			return err;
+		}
 	}
 
 	ib_unregister_device_and_put(device);
-- 
2.34.1

On Wed, Sep 16, 2026 at 06:31:01PM +0000, Wentao Liang wrote:
> nldev_dellink() takes a reference on the ib_device with
> ib_device_get_by_index().  When the driver's dellink callback fails,
> the function returns the error directly without dropping that
> reference, leaking it.  Call ib_device_put() on the dellink error
> path before returning, matching the handling of the other error
> exits in this function.
> 
> Fixes: a60e3f3d6fba ("RDMA/nldev: Add dellink function pointer")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/infiniband/core/nldev.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)

It was already fixed, https://patch.msgid.link/20260903082550.2257-1-lirongqing@baidu.com

Thanks