[PATCH] ice: release the VF reference in the switchdev trust path

[PATCH] ice: release the VF reference in the switchdev trust path

[Wentao Liang]

ice_set_vf_trust() takes a reference on the VF with ice_get_vf_by_id()
and then rejects the request when the PF is in switchdev mode without
dropping that reference.

Return through the existing out_put_vf label so the VF reference is
released on this path too.

Fixes: 1281b7459657 ("ice: Forbid trusted VFs in switchdev mode")
Cc: stable@vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/net/ethernet/intel/ice/ice_sriov.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/ice/ice_sriov.c b/drivers/net/ethernet/intel/ice/ice_sriov.c
index c49f48b5ae38..90bf1becbc3d 100644
--- a/drivers/net/ethernet/intel/ice/ice_sriov.c
+++ b/drivers/net/ethernet/intel/ice/ice_sriov.c
@@ -1400,7 +1400,8 @@ int ice_set_vf_trust(struct net_device *netdev, int vf_id, bool trusted)
 
 	if (ice_is_eswitch_mode_switchdev(pf)) {
 		dev_info(ice_pf_to_dev(pf), "Trusted VF is forbidden in switchdev mode\n");
-		return -EOPNOTSUPP;
+		ret = -EOPNOTSUPP;
+		goto out_put_vf;
 	}
 
 	ret = ice_check_vf_ready_for_cfg(vf);
-- 
2.34.1

Re: [PATCH] ice: release the VF reference in the switchdev trust path

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

 - What hardware the change was tested on. For driver fixes please
   mention the device (and if relevant firmware version) used for
   testing, or say that the change was not tested on real hardware.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH] ice: release the VF reference in the switchdev trust path

[Krzysztof Kozlowski]

On Tue, 03 Nov 2026 10:05:30 +0000, Wentao Liang wrote:
> ice_set_vf_trust() takes a reference on the VF with ice_get_vf_by_id()
> and then rejects the request when the PF is in switchdev mode without
> dropping that reference.
> 
> Return through the existing out_put_vf label so the VF reference is
> released on this path too.
> 
> Fixes: 1281b7459657 ("ice: Forbid trusted VFs in switchdev mode")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/net/ethernet/intel/ice/ice_sriov.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 



Multiple things here:
1. Your team ignored completely previous feedback. Multiple times.

2. You use multiple identities with this email address, thus I doubt that we
   speak with an actual person.

3. Your bot does not even bother running checkpatch, right?

4. Nothing of this was reproduced nor tested.

5. Finally, the same feedback:
You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem (so a patchset grouping multiple patches with a short cover
letter), how to document the issue discovery method and what was
or was not tested.

Best regards,
Krzysztof

Re: [PATCH] ice: release the VF reference in the switchdev trust path

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] ice: incorrect Fixes tag in commit message for ice_set_vf_trust() leak fix
--

commit 42da2ece24c78562b789e051c2ce4c73f6f2c81d
Author: Wentao Liang <vulab@iscas.ac.cn>

ice: release the VF reference in the switchdev trust path

This commit updates ice_set_vf_trust() to jump to the out_put_vf label so
that the VF reference acquired by ice_get_vf_by_id() is released when
rejecting trust changes in switchdev mode.

>     ice: release the VF reference in the switchdev trust path
>     
>     ice_set_vf_trust() takes a reference on the VF with ice_get_vf_by_id()
>     and then rejects the request when the PF is in switchdev mode without
>     dropping that reference.
>     
>     Return through the existing out_put_vf label so the VF reference is
>     released on this path too.
>     
>     Fixes: 1281b7459657 ("ice: Forbid trusted VFs in switchdev mode")
>     Cc: stable@vger.kernel.org
>     Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
>     Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

[Severity: Low]
In drivers/net/ethernet/intel/ice/ice_sriov.c, commit 1281b7459657 ("ice:
Forbid trusted VFs in switchdev mode") placed the
ice_is_eswitch_mode_switchdev(pf) check at the start of ice_set_vf_trust()
prior to looking up the VF. Even after commit 3d5985a185e6 ("ice: convert VF
storage to hash table with krefs and RCU") introduced ice_get_vf_by_id() and
the out_put_vf label, ice_get_vf_by_id() was still called after the switchdev
mode check.

The VF reference leak when ice_is_eswitch_mode_switchdev(pf) is true was
introduced by commit 83b49e7f63da ("ice: check if VF exists before mode
check"), which moved vf = ice_get_vf_by_id(pf, vf_id) above the
ice_is_eswitch_mode_switchdev(pf) check without updating the return
-EOPNOTSUPP path to jump to out_put_vf. Backporting this patch to stable
trees containing 1281b7459657 or 3d5985a185e6 without 83b49e7f63da would jump
to out_put_vf before vf is initialized.

Should the Fixes tag reference commit 83b49e7f63da ("ice: check if VF exists
before mode check") instead?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261103100530.1309907-1-vulab@iscas.ac.cn?part=1