> -----Original Message----- > From: Loktionov, Aleksandr <[email protected]> > Sent: Monday, September 21, 2026 5:30 PM > To: Wentao Liang <[email protected]>; [email protected] > Cc: Nguyen, Anthony L <[email protected]>; [email protected]; > [email protected]; [email protected]; [email protected]; > [email protected]; [email protected]; [email protected]; > Kitszel, Przemyslaw <[email protected]>; [email protected]; > [email protected] > Subject: RE: [PATCH] ixgbevf: fix xfrm_state reference leak in > ixgbevf_ipsec_rx() > > > > > -----Original Message----- > > From: Wentao Liang <[email protected]> > > Sent: Thursday, September 17, 2026 1:14 PM > > To: [email protected] > > Cc: Nguyen, Anthony L <[email protected]>; > > [email protected]; [email protected]; intel-wired- > > [email protected]; [email protected]; [email protected]; > > [email protected]; [email protected]; Kitszel, Przemyslaw > > <[email protected]>; [email protected]; Wentao Liang > > <[email protected]>; [email protected] > > Subject: [PATCH] ixgbevf: fix xfrm_state reference leak in > > ixgbevf_ipsec_rx() > > > > ixgbevf_ipsec_find_rx_state() returns the state with an extra > > reference, which is handed over to the secpath on the success path. > > When > > secpath_set() fails, the state has not been stored anywhere yet and > > the reference is dropped on the floor. > > > > Release it before returning. > > > > Fixes: 0062e7cc955e0 ("ixgbevf: add VF IPsec offload code") > > Cc: [email protected] > > Signed-off-by: Wentao Liang <[email protected]> > > --- > > drivers/net/ethernet/intel/ixgbevf/ipsec.c | 4 +++- > > 1 file changed, 3 insertions(+), 1 deletion(-) > > > > diff --git a/drivers/net/ethernet/intel/ixgbevf/ipsec.c > > b/drivers/net/ethernet/intel/ixgbevf/ipsec.c > > index 076fd0a24858..bf3fcab3bd57 100644 > > --- a/drivers/net/ethernet/intel/ixgbevf/ipsec.c > > +++ b/drivers/net/ethernet/intel/ixgbevf/ipsec.c > > @@ -596,8 +596,10 @@ void ixgbevf_ipsec_rx(struct ixgbevf_ring > > *rx_ring, > > return; > > > > sp = secpath_set(skb); > > - if (unlikely(!sp)) > > + if (unlikely(!sp)) { > > + xfrm_state_put(xs); > > return; > > + } > > > > sp->xvec[sp->len++] = xs; > > sp->olen++; > > -- > > 2.34.1 > > Reviewed-by: Aleksandr Loktionov <[email protected]>
Tested-by: Rafal Romanowski <[email protected]>
