Commit 144539bbfd3c for kernel

commit 144539bbfd3cea1ab0fb6f5216d6004c1f4f029b
Author: Paul Greenwalt <paul.greenwalt@intel.com>
Date:   Fri Jul 17 11:53:32 2026 -0700

    ice: prevent tstamp ring allocation for non-PF VSI types

    The pf->txtime_txqs bitmap tracks which Tx queues have ETF (Earliest
    TxTime First) offload enabled. This bitmap is indexed by queue number
    and is set by ice_offload_txtime(), which only operates on PF VSI
    queues.

    However, ice_is_txtime_ena() does not check the VSI type before
    consulting the bitmap. When ETF offload is enabled on PF Tx queue 0,
    bit 0 is set in pf->txtime_txqs. During a subsequent PCI reset
    rebuild, the CTRL VSI's Tx queue 0 is reconfigured and
    ice_is_txtime_ena() is called for that ring. Since it only checks
    pf->txtime_txqs by queue index without distinguishing VSI type, it
    finds bit 0 set and returns true, matching the PF VSI's ETF queue,
    not the CTRL VSI's. This causes ice_vsi_cfg_txq() to spuriously
    allocate a tstamp_ring for the CTRL VSI ring.

    Since CTRL VSI rings have no associated netdev, ice_clean_tx_ring()
    takes an early return at the !netdev check before reaching
    ice_free_tx_tstamp_ring(), leaking the allocation. Each PCI reset
    leaks one 64-byte tstamp_ring.

    Fix this by restricting ice_is_txtime_ena() to return true only for
    PF VSI rings, since txtime_txqs is only meaningful for PF VSI queues.

    Fixes: ccde82e90946 ("ice: add E830 Earliest TxTime First Offload support")
    Signed-off-by: Paul Greenwalt <paul.greenwalt@intel.com>
    Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
    Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
    Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel)
    Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
    Link: https://patch.msgid.link/20260717185340.3595286-11-anthony.l.nguyen@intel.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h
index f72bb1aa4067..fc91b6665f90 100644
--- a/drivers/net/ethernet/intel/ice/ice.h
+++ b/drivers/net/ethernet/intel/ice/ice.h
@@ -767,6 +767,9 @@ static inline bool ice_is_txtime_ena(const struct ice_tx_ring *ring)
 	struct ice_vsi *vsi = ring->vsi;
 	struct ice_pf *pf = vsi->back;

+	if (vsi->type != ICE_VSI_PF)
+		return false;
+
 	return test_bit(ring->q_index,  pf->txtime_txqs);
 }