* [PATCH] net: prestera: flower: fix ruleset leak in prestera_flower_prio_get()
@ 2026-09-17 11:16 Wentao Liang
2026-09-17 12:18 ` [EXTERNAL] " Elad Nachman
0 siblings, 1 reply; 2+ messages in thread
From: Wentao Liang @ 2026-09-17 11:16 UTC (permalink / raw)
To: andrew+netdev
Cc: davem, edumazet, enachman, kuba, linux-kernel, maksym.glubokiy,
netdev, pabeni, Wentao Liang, stable
prestera_acl_ruleset_lookup() returns the ruleset with its reference
count incremented, and the caller is expected to release it with
prestera_acl_ruleset_put(). prestera_flower_prio_get() only reads the
priority range and returns without dropping the reference, so the
ruleset is never destroyed.
Release the reference after the priorities have been read.
Fixes: 44af95718fed5 ("net: prestera: manage matchall and flower priorities")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
drivers/net/ethernet/marvell/prestera/prestera_flower.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/ethernet/marvell/prestera/prestera_flower.c b/drivers/net/ethernet/marvell/prestera/prestera_flower.c
index 58b116cabd48..10d7e149822b 100644
--- a/drivers/net/ethernet/marvell/prestera/prestera_flower.c
+++ b/drivers/net/ethernet/marvell/prestera/prestera_flower.c
@@ -411,6 +411,8 @@ int prestera_flower_prio_get(struct prestera_flow_block *block, u32 chain_index,
return PTR_ERR(ruleset);
prestera_acl_ruleset_prio_get(ruleset, prio_min, prio_max);
+ prestera_acl_ruleset_put(ruleset);
+
return 0;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 2+ messages in thread* RE: [EXTERNAL] [PATCH] net: prestera: flower: fix ruleset leak in prestera_flower_prio_get()
2026-09-17 11:16 [PATCH] net: prestera: flower: fix ruleset leak in prestera_flower_prio_get() Wentao Liang
@ 2026-09-17 12:18 ` Elad Nachman
0 siblings, 0 replies; 2+ messages in thread
From: Elad Nachman @ 2026-09-17 12:18 UTC (permalink / raw)
To: Wentao Liang
Cc: andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com,
kuba@kernel.org, linux-kernel@vger.kernel.org,
maksym.glubokiy@plvision.eu, netdev@vger.kernel.org,
pabeni@redhat.com, stable@vger.kernel.org
> prestera_acl_ruleset_lookup() returns the ruleset with its reference
> count incremented, and the caller is expected to release it with
> prestera_acl_ruleset_put(). prestera_flower_prio_get() only reads the
> priority range and returns without dropping the reference, so the
> ruleset is never destroyed.
>
> Release the reference after the priorities have been read.
>
> Fixes: 44af95718fed5 ("net: prestera: manage matchall and flower priorities")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
> drivers/net/ethernet/marvell/prestera/prestera_flower.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/net/ethernet/marvell/prestera/prestera_flower.c b/drivers/net/ethernet/marvell/prestera/prestera_flower.c
> index 58b116cabd48..10d7e149822b 100644
> --- a/drivers/net/ethernet/marvell/prestera/prestera_flower.c
> +++ b/drivers/net/ethernet/marvell/prestera/prestera_flower.c
> @@ -411,6 +411,8 @@ int prestera_flower_prio_get(struct prestera_flow_block *block, u32 chain_index,
> return PTR_ERR(ruleset);
>
> prestera_acl_ruleset_prio_get(ruleset, prio_min, prio_max);
> + prestera_acl_ruleset_put(ruleset);
> +
> return 0;
> }
>
> --
> 2.34.1
void prestera_acl_ruleset_put(struct prestera_acl_ruleset *ruleset)
{
if (!refcount_dec_and_test(&ruleset->refcount))
return;
prestera_acl_ruleset_destroy(ruleset);
}
If the refcount was one when you called put, this will destroy the ruleset.
Did you verify that the refcount is at least two on this call to prestera_flower_prio_get() ?
Elad.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-17 12:19 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-17 11:16 [PATCH] net: prestera: flower: fix ruleset leak in prestera_flower_prio_get() Wentao Liang
2026-09-17 12:18 ` [EXTERNAL] " Elad Nachman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox