On Tue, Oct 1, 2024 at 4:06 AM Tony Nguyen <anthony.l.nguyen@xxxxxxxxx> wrote:
>
> From: Gui-Dong Han <hanguidong02@xxxxxxxxxxx>
>
> This patch addresses an issue with improper reference count handling in the
> ice_sriov_set_msix_vec_count() function.
>
> First, the function calls ice_get_vf_by_id(), which increments the
> reference count of the vf pointer. If the subsequent call to
> ice_get_vf_vsi() fails, the function currently returns an error without
> decrementing the reference count of the vf pointer, leading to a reference
> count leak. The correct behavior, as implemented in this patch, is to
> decrement the reference count using ice_put_vf(vf) before returning an
> error when vsi is NULL.
>
> Second, the function calls ice_sriov_get_irqs(), which sets
> vf->first_vector_idx. If this call returns a negative value, indicating an
> error, the function returns an error without decrementing the reference
> count of the vf pointer, resulting in another reference count leak. The
> patch addresses this by adding a call to ice_put_vf(vf) before returning
> an error when vf->first_vector_idx < 0.
>
> This bug was identified by an experimental static analysis tool developed
> by our team. The tool specializes in analyzing reference count operations
> and identifying potential mismanagement of reference counts. In this case,
> the tool flagged the missing decrement operation as a potential issue,
> leading to this patch.
>
> Fixes: 4035c72dc1ba ("ice: reconfig host after changing MSI-X on VF")
> Fixes: 4d38cb44bd32 ("ice: manage VFs MSI-X using resource tracking")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Gui-Dong Han <hanguidong02@xxxxxxxxxxx>
> Reviewed-by: Simon Horman <horms@xxxxxxxxxx>
> Tested-by: Rafal Romanowski <rafal.romanowski@xxxxxxxxx>
> Signed-off-by: Tony Nguyen <anthony.l.nguyen@xxxxxxxxx>
LGTM,
Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@xxxxxxxxxxxx>
--
Regards,
Kalesh A P
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature
