| Message ID | 20260917111114.2148482-1-vulab@iscas.ac.cn |
|---|---|
| State | Under Review |
| Delegated to: | Anthony Nguyen |
| Headers | show |
| Series | ice: fix VF reference leak in ice_set_vf_trust() | expand |
> -----Original Message----- > From: Wentao Liang <vulab@iscas.ac.cn> > Sent: Thursday, September 17, 2026 1:11 PM > To: andrew+netdev@lunn.ch > Cc: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; > davem@davemloft.net; edumazet@google.com; intel-wired- > lan@lists.osuosl.org; kalyan.kodamagula@intel.com; kuba@kernel.org; > linux-kernel@vger.kernel.org; Swiatkowski, Michal > <michal.swiatkowski@intel.com>; netdev@vger.kernel.org; > pabeni@redhat.com; Kitszel, Przemyslaw <przemyslaw.kitszel@intel.com>; > Wentao Liang <vulab@iscas.ac.cn>; stable@vger.kernel.org > Subject: [PATCH] ice: fix VF reference leak in ice_set_vf_trust() > > ice_get_vf_by_id() takes a reference on the VF, which the caller has > to release with ice_put_vf(). The switchdev mode check now happens > after the VF is looked up and returns -EOPNOTSUPP without dropping > that reference, leaking it. > > Use the existing out_put_vf label instead. > > Fixes: 83b49e7f63da ("ice: check if VF exists before mode check") > Cc: stable@vger.kernel.org > Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> > --- > drivers/net/ethernet/intel/ice/ice_sriov.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/ethernet/intel/ice/ice_sriov.c > b/drivers/net/ethernet/intel/ice/ice_sriov.c > index 7e00e091756d..202224dba1a3 100644 > --- a/drivers/net/ethernet/intel/ice/ice_sriov.c > +++ b/drivers/net/ethernet/intel/ice/ice_sriov.c > @@ -1384,7 +1384,8 @@ int ice_set_vf_trust(struct net_device *netdev, > int vf_id, bool trusted) > > if (ice_is_eswitch_mode_switchdev(pf)) { > dev_info(ice_pf_to_dev(pf), "Trusted VF is forbidden in > switchdev mode\n"); > - return -EOPNOTSUPP; > + ret = -EOPNOTSUPP; > + goto out_put_vf; > } > > ret = ice_check_vf_ready_for_cfg(vf); > -- > 2.34.1 Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
> -----Original Message----- > From: Loktionov, Aleksandr <aleksandr.loktionov@intel.com> > Sent: Thursday, September 17, 2026 1:29 PM > To: Wentao Liang <vulab@iscas.ac.cn>; andrew+netdev@lunn.ch > Cc: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; > davem@davemloft.net; edumazet@google.com; intel-wired- > lan@lists.osuosl.org; kalyan.kodamagula@intel.com; kuba@kernel.org; linux- > kernel@vger.kernel.org; Swiatkowski, Michal > <michal.swiatkowski@intel.com>; netdev@vger.kernel.org; > pabeni@redhat.com; Kitszel, Przemyslaw <przemyslaw.kitszel@intel.com>; > stable@vger.kernel.org > Subject: RE: [PATCH] ice: fix VF reference leak in ice_set_vf_trust() > > > > > -----Original Message----- > > From: Wentao Liang <vulab@iscas.ac.cn> > > Sent: Thursday, September 17, 2026 1:11 PM > > To: andrew+netdev@lunn.ch > > Cc: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; > > davem@davemloft.net; edumazet@google.com; intel-wired- > > lan@lists.osuosl.org; kalyan.kodamagula@intel.com; kuba@kernel.org; > > linux-kernel@vger.kernel.org; Swiatkowski, Michal > > <michal.swiatkowski@intel.com>; netdev@vger.kernel.org; > > pabeni@redhat.com; Kitszel, Przemyslaw <przemyslaw.kitszel@intel.com>; > > Wentao Liang <vulab@iscas.ac.cn>; stable@vger.kernel.org > > Subject: [PATCH] ice: fix VF reference leak in ice_set_vf_trust() > > > > ice_get_vf_by_id() takes a reference on the VF, which the caller has > > to release with ice_put_vf(). The switchdev mode check now happens > > after the VF is looked up and returns -EOPNOTSUPP without dropping > > that reference, leaking it. > > > > Use the existing out_put_vf label instead. > > > > Fixes: 83b49e7f63da ("ice: check if VF exists before mode check") > > Cc: stable@vger.kernel.org > > Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> > > --- > > drivers/net/ethernet/intel/ice/ice_sriov.c | 3 ++- > > 1 file changed, 2 insertions(+), 1 deletion(-) > > > > diff --git a/drivers/net/ethernet/intel/ice/ice_sriov.c > > b/drivers/net/ethernet/intel/ice/ice_sriov.c > > index 7e00e091756d..202224dba1a3 100644 > > --- a/drivers/net/ethernet/intel/ice/ice_sriov.c > > +++ b/drivers/net/ethernet/intel/ice/ice_sriov.c > > @@ -1384,7 +1384,8 @@ int ice_set_vf_trust(struct net_device *netdev, > > int vf_id, bool trusted) > > > > if (ice_is_eswitch_mode_switchdev(pf)) { > > dev_info(ice_pf_to_dev(pf), "Trusted VF is forbidden in > switchdev > > mode\n"); > > - return -EOPNOTSUPP; > > + ret = -EOPNOTSUPP; > > + goto out_put_vf; > > } > > > > ret = ice_check_vf_ready_for_cfg(vf); > > -- > > 2.34.1 > > Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Tested-by: Patryk Holda <patryk.holda@intel.com>
diff --git a/drivers/net/ethernet/intel/ice/ice_sriov.c b/drivers/net/ethernet/intel/ice/ice_sriov.c index 7e00e091756d..202224dba1a3 100644 --- a/drivers/net/ethernet/intel/ice/ice_sriov.c +++ b/drivers/net/ethernet/intel/ice/ice_sriov.c @@ -1384,7 +1384,8 @@ int ice_set_vf_trust(struct net_device *netdev, int vf_id, bool trusted) if (ice_is_eswitch_mode_switchdev(pf)) { dev_info(ice_pf_to_dev(pf), "Trusted VF is forbidden in switchdev mode\n"); - return -EOPNOTSUPP; + ret = -EOPNOTSUPP; + goto out_put_vf; } ret = ice_check_vf_ready_for_cfg(vf);
ice_get_vf_by_id() takes a reference on the VF, which the caller has to release with ice_put_vf(). The switchdev mode check now happens after the VF is looked up and returns -EOPNOTSUPP without dropping that reference, leaking it. Use the existing out_put_vf label instead. Fixes: 83b49e7f63da ("ice: check if VF exists before mode check") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> --- drivers/net/ethernet/intel/ice/ice_sriov.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)