RE: [EXTERNAL] [PATCH] net: prestera: flower: fix ruleset leak in prestera_flower_prio_get()
From: Elad Nachman <enachman@marvell.com>
Date: 2026-09-17 12:19:21
Also in:
lkml, stable
quoted hunk ↗ jump to hunk
prestera_acl_ruleset_lookup() returns the ruleset with its reference count incremented, and the caller is expected to release it with prestera_acl_ruleset_put(). prestera_flower_prio_get() only reads the priority range and returns without dropping the reference, so the ruleset is never destroyed. Release the reference after the priorities have been read. Fixes: 44af95718fed5 ("net: prestera: manage matchall and flower priorities") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang <redacted> --- drivers/net/ethernet/marvell/prestera/prestera_flower.c | 2 ++ 1 file changed, 2 insertions(+)diff --git a/drivers/net/ethernet/marvell/prestera/prestera_flower.c b/drivers/net/ethernet/marvell/prestera/prestera_flower.c index 58b116cabd48..10d7e149822b 100644 --- a/drivers/net/ethernet/marvell/prestera/prestera_flower.c +++ b/drivers/net/ethernet/marvell/prestera/prestera_flower.c@@ -411,6 +411,8 @@ int prestera_flower_prio_get(struct prestera_flow_block *block, u32 chain_index, return PTR_ERR(ruleset); prestera_acl_ruleset_prio_get(ruleset, prio_min, prio_max); + prestera_acl_ruleset_put(ruleset); + return 0; } --2.34.1
void prestera_acl_ruleset_put(struct prestera_acl_ruleset *ruleset)
{
if (!refcount_dec_and_test(&ruleset->refcount))
return;
prestera_acl_ruleset_destroy(ruleset);
}
If the refcount was one when you called put, this will destroy the ruleset.
Did you verify that the refcount is at least two on this call to prestera_flower_prio_get() ?
Elad.