RE: [EXTERNAL] [PATCH] net: prestera: flower: fix ruleset leak in prestera_flower_prio_get()

[Elad Nachman]

> prestera_acl_ruleset_lookup() returns the ruleset with its reference
> count incremented, and the caller is expected to release it with
> prestera_acl_ruleset_put(). prestera_flower_prio_get() only reads the
> priority range and returns without dropping the reference, so the
> ruleset is never destroyed.
>
> Release the reference after the priorities have been read.
>
> Fixes: 44af95718fed5 ("net: prestera: manage matchall and flower priorities")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
> ---
>  drivers/net/ethernet/marvell/prestera/prestera_flower.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/net/ethernet/marvell/prestera/prestera_flower.c b/drivers/net/ethernet/marvell/prestera/prestera_flower.c
> index 58b116cabd48..10d7e149822b 100644
> --- a/drivers/net/ethernet/marvell/prestera/prestera_flower.c
> +++ b/drivers/net/ethernet/marvell/prestera/prestera_flower.c
> @@ -411,6 +411,8 @@ int prestera_flower_prio_get(struct prestera_flow_block *block, u32 chain_index,
>               return PTR_ERR(ruleset);
>
>       prestera_acl_ruleset_prio_get(ruleset, prio_min, prio_max);
> +     prestera_acl_ruleset_put(ruleset);
> +
>       return 0;
>  }
>
> --
> 2.34.1

void prestera_acl_ruleset_put(struct prestera_acl_ruleset *ruleset)
{
	if (!refcount_dec_and_test(&ruleset->refcount))
		return;

	prestera_acl_ruleset_destroy(ruleset);
}

If the refcount was one when you called put, this will destroy the ruleset.
Did you verify that the refcount is at least two on this call to prestera_flower_prio_get() ?

Elad.