Re: [PATCH rdma-next 0/2] RDMA/counter: Two bug fixes in counter error paths

[Jason Gunthorpe]

On Wed, May 20, 2026 at 06:45:44PM +0800, Tao Cui wrote:
> This small series fixes two bugs in the RDMA counter subsystem,
> both related to error cleanup paths in drivers/infiniband/core/counters.c.
> 
> Patch 1 fixes a variable mismatch in rdma_counter_init()'s cleanup loop:
> the loop iterates with 'i' but indexes into port_data[] with 'port',
> causing double-frees on the failed port and leaking hstats of
> previously initialized ports.
> 
> Patch 2 fixes a num_counters leak in alloc_and_bind(): when
> __rdma_counter_bind_qp() fails, the counter is freed without
> decrementing port_counter->num_counters.  This leak accumulates
> across repeated failures, permanently preventing the port from
> switching back to AUTO mode (-EBUSY) and leaving the mode stuck
> in MANUAL when it was originally NONE.
> 
> Tao Cui (2):
>   RDMA/counter: Fix num_counters leak on bind_qp failure in
>     alloc_and_bind()
>   RDMA/counter: Fix incorrect port index in rdma_counter_init() error
>     cleanup

Applied to for-next

Thanks,
Jason