On Wed, Apr 20, 2022 at 08:40:39PM -0500, Bob Pearson wrote: > +void rxe_mw_cleanup(struct rxe_pool_elem *elem) > +{ > + struct rxe_mw *mw = container_of(elem, typeof(*mw), elem); > + struct rxe_pd *pd = to_rpd(mw->ibmw.pd); > + > + rxe_put(pd); > + > + if (mw->mr) { > + struct rxe_mr *mr = mw->mr; > + > + mw->mr = NULL; > + atomic_dec(&mr->num_mw); > + rxe_put(mr); > + } > + > + if (mw->qp) { > + struct rxe_qp *qp = mw->qp; > + > + mw->qp = NULL; > + rxe_put(qp); > + } > + > + mw->access = 0; > + mw->addr = 0; > + mw->length = 0; > + mw->state = RXE_MW_STATE_INVALID; > +} The cleanup functions are all called directly before kfree while the ref is zero - why do we need to zero the memory here? Jason