Patch "RDMA/mlx5: Fix bind QP error cleanup flow" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    RDMA/mlx5: Fix bind QP error cleanup flow

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     rdma-mlx5-fix-bind-qp-error-cleanup-flow.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit dd16e257721f61a0e279d885ef8a99e1092f2f92
Author: Patrisious Haddad <phaddad@xxxxxxxxxx>
Date:   Thu Feb 20 08:47:10 2025 +0200

    RDMA/mlx5: Fix bind QP error cleanup flow
    
    [ Upstream commit e1a0bdbdfdf08428f0ede5ae49c7f4139ac73ef5 ]
    
    When there is a failure during bind QP, the cleanup flow destroys the
    counter regardless if it is the one that created it or not, which is
    problematic since if it isn't the one that created it, that counter could
    still be in use.
    
    Fix that by destroying the counter only if it was created during this call.
    
    Fixes: 45842fc627c7 ("IB/mlx5: Support statistic q counter configuration")
    Signed-off-by: Patrisious Haddad <phaddad@xxxxxxxxxx>
    Reviewed-by: Mark Zhang <markzhang@xxxxxxxxxx>
    Link: https://patch.msgid.link/25dfefddb0ebefa668c32e06a94d84e3216257cf.1740033937.git.leon@xxxxxxxxxx
    Reviewed-by: Zhu Yanjun <yanjun.zhu@xxxxxxxxx>
    Signed-off-by: Leon Romanovsky <leon@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/infiniband/hw/mlx5/counters.c b/drivers/infiniband/hw/mlx5/counters.c
index 1a0ecf439c099..870a089198116 100644
--- a/drivers/infiniband/hw/mlx5/counters.c
+++ b/drivers/infiniband/hw/mlx5/counters.c
@@ -337,6 +337,7 @@ static int mlx5_ib_counter_bind_qp(struct rdma_counter *counter,
 				   struct ib_qp *qp)
 {
 	struct mlx5_ib_dev *dev = to_mdev(qp->device);
+	bool new = false;
 	int err;
 
 	if (!counter->id) {
@@ -351,6 +352,7 @@ static int mlx5_ib_counter_bind_qp(struct rdma_counter *counter,
 			return err;
 		counter->id =
 			MLX5_GET(alloc_q_counter_out, out, counter_set_id);
+		new = true;
 	}
 
 	err = mlx5_ib_qp_set_counter(qp, counter);
@@ -360,8 +362,10 @@ static int mlx5_ib_counter_bind_qp(struct rdma_counter *counter,
 	return 0;
 
 fail_set_counter:
-	mlx5_ib_counter_dealloc(counter);
-	counter->id = 0;
+	if (new) {
+		mlx5_ib_counter_dealloc(counter);
+		counter->id = 0;
+	}
 
 	return err;
 }