From: Tao Cui Date: Wed, 20 May 2026 10:45:46 +0000 (+0800) Subject: RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b86fd95805a7bd4c5b9465c9e7f75e45bbe7eb6f;p=thirdparty%2Fkernel%2Flinux.git RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup The error cleanup loop in rdma_counter_init() iterates with variable 'i' but accesses dev->port_data[port] instead of dev->port_data[i]. This causes the failed port's hstats to be freed multiple times while leaking hstats of previously initialized ports. Fixes: 56594ae1d250 ("RDMA/core: Annotate destroy of mutex to ensure that it is released as unlocked") Link: https://patch.msgid.link/r/20260520104546.1776253-3-cuitao@kylinos.cn Signed-off-by: Tao Cui Signed-off-by: Jason Gunthorpe --- diff --git a/drivers/infiniband/core/counters.c b/drivers/infiniband/core/counters.c index 5ddd607d5fbef..a9e189194c130 100644 --- a/drivers/infiniband/core/counters.c +++ b/drivers/infiniband/core/counters.c @@ -669,7 +669,7 @@ void rdma_counter_init(struct ib_device *dev) fail: for (i = port; i >= rdma_start_port(dev); i--) { - port_counter = &dev->port_data[port].port_counter; + port_counter = &dev->port_data[i].port_counter; rdma_free_hw_stats_struct(port_counter->hstats); port_counter->hstats = NULL; mutex_destroy(&port_counter->lock);