Re: [PATCH] ice: release the VF reference in the switchdev trust path

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] ice: incorrect Fixes tag in commit message for ice_set_vf_trust() leak fix
--

commit 42da2ece24c78562b789e051c2ce4c73f6f2c81d
Author: Wentao Liang <vulab@iscas.ac.cn>

ice: release the VF reference in the switchdev trust path

This commit updates ice_set_vf_trust() to jump to the out_put_vf label so
that the VF reference acquired by ice_get_vf_by_id() is released when
rejecting trust changes in switchdev mode.

>     ice: release the VF reference in the switchdev trust path
>     
>     ice_set_vf_trust() takes a reference on the VF with ice_get_vf_by_id()
>     and then rejects the request when the PF is in switchdev mode without
>     dropping that reference.
>     
>     Return through the existing out_put_vf label so the VF reference is
>     released on this path too.
>     
>     Fixes: 1281b7459657 ("ice: Forbid trusted VFs in switchdev mode")
>     Cc: stable@vger.kernel.org
>     Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
>     Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

[Severity: Low]
In drivers/net/ethernet/intel/ice/ice_sriov.c, commit 1281b7459657 ("ice:
Forbid trusted VFs in switchdev mode") placed the
ice_is_eswitch_mode_switchdev(pf) check at the start of ice_set_vf_trust()
prior to looking up the VF. Even after commit 3d5985a185e6 ("ice: convert VF
storage to hash table with krefs and RCU") introduced ice_get_vf_by_id() and
the out_put_vf label, ice_get_vf_by_id() was still called after the switchdev
mode check.

The VF reference leak when ice_is_eswitch_mode_switchdev(pf) is true was
introduced by commit 83b49e7f63da ("ice: check if VF exists before mode
check"), which moved vf = ice_get_vf_by_id(pf, vf_id) above the
ice_is_eswitch_mode_switchdev(pf) check without updating the return
-EOPNOTSUPP path to jump to out_put_vf. Backporting this patch to stable
trees containing 1281b7459657 or 3d5985a185e6 without 83b49e7f63da would jump
to out_put_vf before vf is initialized.

Should the Fixes tag reference commit 83b49e7f63da ("ice: check if VF exists
before mode check") instead?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261103100530.1309907-1-vulab@iscas.ac.cn?part=1