RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup

The error cleanup loop in rdma_counter_init() iterates with variable
'i' but accesses dev->port_data[port] instead of dev->port_data[i].
This causes the failed port's hstats to be freed multiple times while
leaking hstats of previously initialized ports.

Fixes: 56594ae1d250 ("RDMA/core: Annotate destroy of mutex to ensure that it is released as unlocked")
Link: https://patch.msgid.link/r/20260520104546.1776253-3-cuitao@kylinos.cn
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

diff --git a/drivers/infiniband/core/counters.c b/drivers/infiniband/core/counters.c
index 5ddd607d5fbef4a19b22d9864f8cc91725879ee7..a9e189194c1300a37479502959ddc1d1687bd40e 100644 (file)
--- a/drivers/infiniband/core/counters.c
+++ b/drivers/infiniband/core/counters.c
@@ -669,7 +669,7 @@ void rdma_counter_init(struct ib_device *dev)
 
 fail:
        for (i = port; i >= rdma_start_port(dev); i--) {
-               port_counter = &dev->port_data[port].port_counter;
+               port_counter = &dev->port_data[i].port_counter;
                rdma_free_hw_stats_struct(port_counter->hstats);
                port_counter->hstats = NULL;
                mutex_destroy(&port_counter->lock);