ice_get_vf_by_id() takes a reference on the VF, which the caller has to
release with ice_put_vf(). The switchdev mode check now happens after
the VF is looked up and returns -EOPNOTSUPP without dropping that
reference, leaking it.

Use the existing out_put_vf label instead.

Fixes: 83b49e7f63da ("ice: check if VF exists before mode check")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/net/ethernet/intel/ice/ice_sriov.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/ice/ice_sriov.c b/drivers/net/ethernet/intel/ice/ice_sriov.c
index 7e00e091756d..202224dba1a3 100644
--- a/drivers/net/ethernet/intel/ice/ice_sriov.c
+++ b/drivers/net/ethernet/intel/ice/ice_sriov.c
@@ -1384,7 +1384,8 @@ int ice_set_vf_trust(struct net_device *netdev, int vf_id, bool trusted)
 
 	if (ice_is_eswitch_mode_switchdev(pf)) {
 		dev_info(ice_pf_to_dev(pf), "Trusted VF is forbidden in switchdev mode\n");
-		return -EOPNOTSUPP;
+		ret = -EOPNOTSUPP;
+		goto out_put_vf;
 	}
 
 	ret = ice_check_vf_ready_for_cfg(vf);
-- 
2.34.1

> -----Original Message-----
> From: Wentao Liang <vulab@iscas.ac.cn>
> Sent: Thursday, September 17, 2026 1:11 PM
> To: andrew+netdev@lunn.ch
> Cc: Nguyen, Anthony L <anthony.l.nguyen@intel.com>;
> davem@davemloft.net; edumazet@google.com; intel-wired-
> lan@lists.osuosl.org; kalyan.kodamagula@intel.com; kuba@kernel.org;
> linux-kernel@vger.kernel.org; Swiatkowski, Michal
> <michal.swiatkowski@intel.com>; netdev@vger.kernel.org;
> pabeni@redhat.com; Kitszel, Przemyslaw <przemyslaw.kitszel@intel.com>;
> Wentao Liang <vulab@iscas.ac.cn>; stable@vger.kernel.org
> Subject: [PATCH] ice: fix VF reference leak in ice_set_vf_trust()
> 
> ice_get_vf_by_id() takes a reference on the VF, which the caller has
> to release with ice_put_vf(). The switchdev mode check now happens
> after the VF is looked up and returns -EOPNOTSUPP without dropping
> that reference, leaking it.
> 
> Use the existing out_put_vf label instead.
> 
> Fixes: 83b49e7f63da ("ice: check if VF exists before mode check")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/net/ethernet/intel/ice/ice_sriov.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/intel/ice/ice_sriov.c
> b/drivers/net/ethernet/intel/ice/ice_sriov.c
> index 7e00e091756d..202224dba1a3 100644
> --- a/drivers/net/ethernet/intel/ice/ice_sriov.c
> +++ b/drivers/net/ethernet/intel/ice/ice_sriov.c
> @@ -1384,7 +1384,8 @@ int ice_set_vf_trust(struct net_device *netdev,
> int vf_id, bool trusted)
> 
>  	if (ice_is_eswitch_mode_switchdev(pf)) {
>  		dev_info(ice_pf_to_dev(pf), "Trusted VF is forbidden in
> switchdev mode\n");
> -		return -EOPNOTSUPP;
> +		ret = -EOPNOTSUPP;
> +		goto out_put_vf;
>  	}
> 
>  	ret = ice_check_vf_ready_for_cfg(vf);
> --
> 2.34.1

Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>