patch 'net/ice: fix shaper profile reference count tracking' has been queued to stable release 24.11.7

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 06/13/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/cad657be1455e32fc4c5d3f1e10afeb2f0c7b4d1

Thanks.

Luca Boccassi

---
>From cad657be1455e32fc4c5d3f1e10afeb2f0c7b4d1 Mon Sep 17 00:00:00 2001
From: Ciara Loftus <ciara.loftus at intel.com>
Date: Thu, 7 May 2026 12:59:30 +0000
Subject: [PATCH] net/ice: fix shaper profile reference count tracking

[ upstream commit df9ac97b7819a6cb6b1bba518c5e196e11c6c417 ]

Currently, when a TM node is added with a shaper profile assigned,
the profile's reference count is not incremented. Equally, when a node
is deleted, the count is not decremented. As a result, the guard that
blocks deletion of an in-use profile never triggers, allowing the profile
to be freed while nodes still hold a pointer to it.

Fix by maintaining the reference count correctly when nodes take or
release a shaper profile, so that deletion of an in-use profile is
properly rejected.

Fixes: 8c481c3bb65b ("net/ice: support queue and queue group bandwidth limit")

Signed-off-by: Ciara Loftus <ciara.loftus at intel.com>
Acked-by: Bruce Richardson <bruce.richardson at intel.com>
---
 drivers/net/ice/ice_tm.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/ice/ice_tm.c b/drivers/net/ice/ice_tm.c
index 2bb684bb02..015a827d7a 100644
--- a/drivers/net/ice/ice_tm.c
+++ b/drivers/net/ice/ice_tm.c
@@ -456,6 +456,8 @@ ice_tm_node_add(struct rte_eth_dev *dev, uint32_t node_id,
 		tm_node->parent = NULL;
 		tm_node->reference_count = 0;
 		tm_node->shaper_profile = shaper_profile;
+		if (shaper_profile != NULL)
+			shaper_profile->reference_count++;
 		tm_node->children = RTE_PTR_ADD(tm_node, sizeof(struct ice_tm_node));
 		tm_node->params = *params;
 		pf->tm_conf.root = tm_node;
@@ -518,6 +520,8 @@ ice_tm_node_add(struct rte_eth_dev *dev, uint32_t node_id,
 	tm_node->parent = parent_node;
 	tm_node->level = level_id;
 	tm_node->shaper_profile = shaper_profile;
+	if (shaper_profile != NULL)
+		shaper_profile->reference_count++;
 	tm_node->children = RTE_PTR_ADD(tm_node, sizeof(struct ice_tm_node));
 	tm_node->parent->children[tm_node->parent->reference_count++] = tm_node;
 	tm_node->params = *params;
@@ -568,6 +572,8 @@ ice_tm_node_delete(struct rte_eth_dev *dev, uint32_t node_id,
 
 	/* root node */
 	if (tm_node->level == 0) {
+		if (tm_node->shaper_profile != NULL)
+			tm_node->shaper_profile->reference_count--;
 		rte_free(tm_node);
 		pf->tm_conf.root = NULL;
 		return 0;
@@ -582,6 +588,8 @@ ice_tm_node_delete(struct rte_eth_dev *dev, uint32_t node_id,
 		tm_node->parent->children[j] = tm_node->parent->children[j + 1];
 
 	tm_node->parent->reference_count--;
+	if (tm_node->shaper_profile != NULL)
+		tm_node->shaper_profile->reference_count--;
 	rte_free(tm_node);
 
 	return 0;
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-06-11 14:20:03.308436263 +0100
+++ 0050-net-ice-fix-shaper-profile-reference-count-tracking.patch	2026-06-11 14:20:01.238746566 +0100
@@ -1 +1 @@
-From df9ac97b7819a6cb6b1bba518c5e196e11c6c417 Mon Sep 17 00:00:00 2001
+From cad657be1455e32fc4c5d3f1e10afeb2f0c7b4d1 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit df9ac97b7819a6cb6b1bba518c5e196e11c6c417 ]
+
@@ -17 +18,0 @@
-Cc: stable at dpdk.org
@@ -22 +23 @@
- drivers/net/intel/ice/ice_tm.c | 8 ++++++++
+ drivers/net/ice/ice_tm.c | 8 ++++++++
@@ -25 +26 @@
-diff --git a/drivers/net/intel/ice/ice_tm.c b/drivers/net/intel/ice/ice_tm.c
+diff --git a/drivers/net/ice/ice_tm.c b/drivers/net/ice/ice_tm.c
@@ -27,2 +28,2 @@
---- a/drivers/net/intel/ice/ice_tm.c
-+++ b/drivers/net/intel/ice/ice_tm.c
+--- a/drivers/net/ice/ice_tm.c
++++ b/drivers/net/ice/ice_tm.c