[PATCH 5.10/5.15] RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one

[Mikhail Dmitrichenko]

From: Leon Romanovsky <leonro@xxxxxxxxxx>

commit 449ae7927152e46acbe5f19f97eafdae6d3a96b1 upstream.

Free the UAR index returned by the hardware.

Fixes: 4ed131d0bb15 ("IB/mlx5: Expose dynamic mmap allocation")
Link: https://patch.msgid.link/r/20260611-fix-uar-release-v1-1-f5464d845dbf@xxxxxxxxxx
Signed-off-by: Leon Romanovsky <leonro@xxxxxxxxxx>
Signed-off-by: Jason Gunthorpe <jgg@xxxxxxxxxx>
[ mdmitrichenko: Apply the index fix to mlx5_cmd_free_uar(), as
  5.10 and 5.15 predate the DevX UID-aware UAR helpers. ]
Signed-off-by: Mikhail Dmitrichenko <mdmitrichenko@xxxxxxxxxxxxx>
---
Backport fix for CVE-2026-74296

 drivers/infiniband/hw/mlx5/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 56151a616b07..a0d3eba45639 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -2262,7 +2262,7 @@ static int uar_mmap(struct mlx5_ib_dev *dev, enum mlx5_ib_mmap_cmd cmd,
 	if (!dyn_uar)
 		return err;
 
-	mlx5_cmd_free_uar(dev->mdev, idx);
+	mlx5_cmd_free_uar(dev->mdev, uar_index);
 
 free_bfreg:
 	mlx5_ib_free_bfreg(dev, bfregi, bfreg_dyn_idx);
-- 
2.43.0