[PATCH 0/3] net/iavf: fix TM hierarchy commit and TM ops without QoS

[PATCH 0/3] net/iavf: fix TM hierarchy commit and TM ops without QoS

[Dawid Wesierski]

Three fixes in the iavf traffic manager.

Patch 1 removes a second free of the queue TC map. The fault is in main
only, after commit f6e33f09f766. No release has it.

Patch 2 sets the queue ID and TC of each queue node in the queue
bandwidth message. Without it, a queue node with no shaper profile
resets queue 0, and its own queue keeps the rate limit that the PF
holds from an earlier process.

Patch 3 returns -ENOTSUP from the TM ops that read qos_cap when the PF
does not grant VIRTCHNL_VF_OFFLOAD_QOS, for example the in-tree ice PF.
These ops cause a segmentation fault now.

The Media Transport Library carries patches 2 and 3 on DPDK 26.07, and
tests them on E830 VFs with the out-of-tree ice PF. On a VF that an
earlier process rate limited, a TSC-paced 1080p59.94 stream runs at
27.5 fps. With patch 2, a commit of queue nodes without shaper profiles
removes the old limits, and the stream runs at 59.9 fps.

Dawid Wesierski (3):
  net/iavf: fix invalid free of queue TC map
  net/iavf: fix bandwidth config of unshaped queues
  net/iavf: fix crash in TM ops without QoS capability

 drivers/net/intel/iavf/iavf_tm.c | 42 ++++++++++++++++++++++++++++----
 1 file changed, 37 insertions(+), 5 deletions(-)


base-commit: b39ee12b030f49c524b9d8c350a0f4b04141ccf9
-- 
2.43.0

---------------------------------------------------------------------
Intel Technology Poland sp. z o.o.
ul. Slowackiego 173 | 80-298 Gdansk | Sad Rejonowy Gdansk Polnoc | VII Wydzial Gospodarczy Krajowego Rejestru Sadowego - KRS 101882 | NIP 957-07-52-316 | Kapital zakladowy 200.000 PLN.
Spolka oswiadcza, ze posiada status duzego przedsiebiorcy w rozumieniu ustawy z dnia 8 marca 2013 r. o przeciwdzialaniu nadmiernym opoznieniom w transakcjach handlowych.

Ta wiadomosc wraz z zalacznikami jest przeznaczona dla okreslonego adresata i moze zawierac informacje poufne. W razie przypadkowego otrzymania tej wiadomosci, prosimy o powiadomienie nadawcy oraz trwale jej usuniecie; jakiekolwiek przegladanie lub rozpowszechnianie jest zabronione.
This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). If you are not the intended recipient, please contact the sender and delete all copies; any review or distribution by others is strictly prohibited.

[PATCH 1/3] net/iavf: fix invalid free of queue TC map

[Dawid Wesierski]

iavf_hierarchy_commit() allocates the queue TC map with calloc(), and
it frees the previous map with free(old_qtc_map) after a successful
commit. A later change added rte_free(vf->qtc_map) in front of that
free(), because it was written for a tree that still leaked the map.

After the first commit, rte_free() gets a pointer from the libc
heap, and free() then releases the same pointer a second time.
rte_free() reads a malloc_elem header in the bytes in front of the
pointer. It usually logs "Invalid memory" and returns, but the result
depends on the contents of the libc heap.

Remove the rte_free() call. free(old_qtc_map) releases the old map.

Fixes: f6e33f09f766 ("net/iavf: disable runtime queue setup when rate limiting")

Signed-off-by: Dawid Wesierski <dawid.wesierski@intel.com>
---
 drivers/net/intel/iavf/iavf_tm.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/net/intel/iavf/iavf_tm.c b/drivers/net/intel/iavf/iavf_tm.c
index fc84bf7e6b..603da09bb5 100644
--- a/drivers/net/intel/iavf/iavf_tm.c
+++ b/drivers/net/intel/iavf/iavf_tm.c
@@ -913,7 +913,6 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
 		goto fail_clear;
 
 	/* replace the previously committed mapping, if any */
-	rte_free(vf->qtc_map);
 	vf->qtc_map = qtc_map;
 	free(old_qtc_map);
 	if (adapter->stopped == 1)
-- 
2.43.0

---------------------------------------------------------------------
Intel Technology Poland sp. z o.o.
ul. Slowackiego 173 | 80-298 Gdansk | Sad Rejonowy Gdansk Polnoc | VII Wydzial Gospodarczy Krajowego Rejestru Sadowego - KRS 101882 | NIP 957-07-52-316 | Kapital zakladowy 200.000 PLN.
Spolka oswiadcza, ze posiada status duzego przedsiebiorcy w rozumieniu ustawy z dnia 8 marca 2013 r. o przeciwdzialaniu nadmiernym opoznieniom w transakcjach handlowych.

Ta wiadomosc wraz z zalacznikami jest przeznaczona dla okreslonego adresata i moze zawierac informacje poufne. W razie przypadkowego otrzymania tej wiadomosci, prosimy o powiadomienie nadawcy oraz trwale jej usuniecie; jakiekolwiek przegladanie lub rozpowszechnianie jest zabronione.
This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). If you are not the intended recipient, please contact the sender and delete all copies; any review or distribution by others is strictly prohibited.

Re: [PATCH 1/3] net/iavf: fix invalid free of queue TC map

[Bruce Richardson]

On Wed, Oct 14, 2026 at 12:24:16PM +0000, Dawid Wesierski wrote:
> iavf_hierarchy_commit() allocates the queue TC map with calloc(), and
> it frees the previous map with free(old_qtc_map) after a successful
> commit. A later change added rte_free(vf->qtc_map) in front of that
> free(), because it was written for a tree that still leaked the map.
> 
> After the first commit, rte_free() gets a pointer from the libc
> heap, and free() then releases the same pointer a second time.
> rte_free() reads a malloc_elem header in the bytes in front of the
> pointer. It usually logs "Invalid memory" and returns, but the result
> depends on the contents of the libc heap.
> 
> Remove the rte_free() call. free(old_qtc_map) releases the old map.
> 
> Fixes: f6e33f09f766 ("net/iavf: disable runtime queue setup when rate limiting")
> 
> Signed-off-by: Dawid Wesierski <dawid.wesierski@intel.com>
> ---
Acked-by: Bruce Richardson <bruce.richardson@intel.com>
>  drivers/net/intel/iavf/iavf_tm.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/drivers/net/intel/iavf/iavf_tm.c b/drivers/net/intel/iavf/iavf_tm.c
> index fc84bf7e6b..603da09bb5 100644
> --- a/drivers/net/intel/iavf/iavf_tm.c
> +++ b/drivers/net/intel/iavf/iavf_tm.c
> @@ -913,7 +913,6 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
>  		goto fail_clear;
>  
>  	/* replace the previously committed mapping, if any */
> -	rte_free(vf->qtc_map);
>  	vf->qtc_map = qtc_map;
>  	free(old_qtc_map);
>  	if (adapter->stopped == 1)
> -- 
> 2.43.0
> 

Re: [PATCH 1/3] net/iavf: fix invalid free of queue TC map

[Bruce Richardson]

On Mon, Oct 19, 2026 at 05:47:16PM +0100, Bruce Richardson wrote:
> On Wed, Oct 14, 2026 at 12:24:16PM +0000, Dawid Wesierski wrote:
> > iavf_hierarchy_commit() allocates the queue TC map with calloc(), and
> > it frees the previous map with free(old_qtc_map) after a successful
> > commit. A later change added rte_free(vf->qtc_map) in front of that
> > free(), because it was written for a tree that still leaked the map.
> > 
> > After the first commit, rte_free() gets a pointer from the libc
> > heap, and free() then releases the same pointer a second time.
> > rte_free() reads a malloc_elem header in the bytes in front of the
> > pointer. It usually logs "Invalid memory" and returns, but the result
> > depends on the contents of the libc heap.
> > 
> > Remove the rte_free() call. free(old_qtc_map) releases the old map.
> > 
> > Fixes: f6e33f09f766 ("net/iavf: disable runtime queue setup when rate limiting")

AI review flags the fact that this commit also introduces an erroneous
rte_free call in iavf_uninit_vf() in iavf_ethdev.c. While the call is
harmless (and earler free is done and the pointer is set to NULL making
rte_free a no-op) it would be good to remove that too.

> > 
> > Signed-off-by: Dawid Wesierski <dawid.wesierski@intel.com>
> > ---
> Acked-by: Bruce Richardson <bruce.richardson@intel.com>
> >  drivers/net/intel/iavf/iavf_tm.c | 1 -
> >  1 file changed, 1 deletion(-)
> > 
> > diff --git a/drivers/net/intel/iavf/iavf_tm.c b/drivers/net/intel/iavf/iavf_tm.c
> > index fc84bf7e6b..603da09bb5 100644
> > --- a/drivers/net/intel/iavf/iavf_tm.c
> > +++ b/drivers/net/intel/iavf/iavf_tm.c
> > @@ -913,7 +913,6 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
> >  		goto fail_clear;
> >  
> >  	/* replace the previously committed mapping, if any */
> > -	rte_free(vf->qtc_map);
> >  	vf->qtc_map = qtc_map;
> >  	free(old_qtc_map);
> >  	if (adapter->stopped == 1)
> > -- 
> > 2.43.0
> > 

[PATCH 2/3] net/iavf: fix bandwidth config of unshaped queues

[Dawid Wesierski]

iavf_hierarchy_commit() sends one virtchnl_queue_bw entry for each queue
node, but it sets queue_id and tc only for a node that has a shaper
profile. The entry of a node without a profile keeps queue_id 0 and
tc 0. The PF then applies the default bandwidth to queue 0 once for
each such entry, and the queue that the node describes keeps its old
rate limit.

The ice PF keeps the queue rate limits of a VF and applies them again
at each queue enable, also for a later process on the same VF. Thus an
application cannot remove the rate limits of an earlier process with a
commit of queue nodes without shaper profiles.

Set queue_id and tc for each queue node. A node without a shaper
profile now gives the default bandwidth to its own queue.

Fixes: 5779a8894d15 ("net/iavf: support queue rate limit configuration")
Cc: stable@dpdk.org

Signed-off-by: Dawid Wesierski <dawid.wesierski@intel.com>
---
 drivers/net/intel/iavf/iavf_tm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/intel/iavf/iavf_tm.c b/drivers/net/intel/iavf/iavf_tm.c
index 603da09bb5..57075ee5b8 100644
--- a/drivers/net/intel/iavf/iavf_tm.c
+++ b/drivers/net/intel/iavf/iavf_tm.c
@@ -867,15 +867,15 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
 		}
 		q_tc_mapping->tc[tm_node->tc].req.queue_count++;
 
+		q_bw->cfg[node_committed].queue_id = tm_node->id;
+		q_bw->cfg[node_committed].tc = tm_node->tc;
 		if (tm_node->shaper_profile) {
-			q_bw->cfg[node_committed].queue_id = tm_node->id;
 			q_bw->cfg[node_committed].shaper.peak =
 			tm_node->shaper_profile->profile.peak.rate /
 			1000 * IAVF_BITS_PER_BYTE;
 			q_bw->cfg[node_committed].shaper.committed =
 			tm_node->shaper_profile->profile.committed.rate /
 			1000 * IAVF_BITS_PER_BYTE;
-			q_bw->cfg[node_committed].tc = tm_node->tc;
 		}
 
 		node_committed++;
-- 
2.43.0

---------------------------------------------------------------------
Intel Technology Poland sp. z o.o.
ul. Slowackiego 173 | 80-298 Gdansk | Sad Rejonowy Gdansk Polnoc | VII Wydzial Gospodarczy Krajowego Rejestru Sadowego - KRS 101882 | NIP 957-07-52-316 | Kapital zakladowy 200.000 PLN.
Spolka oswiadcza, ze posiada status duzego przedsiebiorcy w rozumieniu ustawy z dnia 8 marca 2013 r. o przeciwdzialaniu nadmiernym opoznieniom w transakcjach handlowych.

Ta wiadomosc wraz z zalacznikami jest przeznaczona dla okreslonego adresata i moze zawierac informacje poufne. W razie przypadkowego otrzymania tej wiadomosci, prosimy o powiadomienie nadawcy oraz trwale jej usuniecie; jakiekolwiek przegladanie lub rozpowszechnianie jest zabronione.
This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). If you are not the intended recipient, please contact the sender and delete all copies; any review or distribution by others is strictly prohibited.

Re: [PATCH 2/3] net/iavf: fix bandwidth config of unshaped queues

[Bruce Richardson]

On Wed, Oct 14, 2026 at 12:24:17PM +0000, Dawid Wesierski wrote:
> iavf_hierarchy_commit() sends one virtchnl_queue_bw entry for each queue
> node, but it sets queue_id and tc only for a node that has a shaper
> profile. The entry of a node without a profile keeps queue_id 0 and
> tc 0. The PF then applies the default bandwidth to queue 0 once for
> each such entry, and the queue that the node describes keeps its old
> rate limit.
> 
> The ice PF keeps the queue rate limits of a VF and applies them again
> at each queue enable, also for a later process on the same VF. Thus an
> application cannot remove the rate limits of an earlier process with a
> commit of queue nodes without shaper profiles.
> 
> Set queue_id and tc for each queue node. A node without a shaper
> profile now gives the default bandwidth to its own queue.
> 
> Fixes: 5779a8894d15 ("net/iavf: support queue rate limit configuration")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Dawid Wesierski <dawid.wesierski@intel.com>
> ---
>  drivers/net/intel/iavf/iavf_tm.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 

Acked-by: Bruce Richardson <bruce.richardson@intel.com>

I find the commit log of this patch a bit confusing to read and understand.
I asked AI to try and make things clearer and it suggests this as a
rewording, which I personally find clearer. WDYT?

  When configuring queue bandwidth via virtchnl in iavf_hierarchy_commit(),
  an entry in the bandwidth configuration array is allocated for each queue
  node. However, the driver only populated queue_id and tc for nodes that
  had an active shaper profile.
  
  Because the configuration buffer is zero-initialized with calloc(), any
  unshaped queue node left its entry with queue_id 0, tc 0, and zero rate
  limits. Consequently, the PF interpreted each unshaped queue entry as a
  request to reset queue 0 to default bandwidth, leaving the actual target
  queue untouched on the PF. Any previously configured rate limit on that
  queue remained active, even across subsequent queue enables or process
  restarts.
  
  Fix this by setting queue_id and tc for every queue node, ensuring
  unshaped queues properly send zeroed shaper rates for their own queue ID
  so the PF restores their default bandwidth.
  


> diff --git a/drivers/net/intel/iavf/iavf_tm.c b/drivers/net/intel/iavf/iavf_tm.c
> index 603da09bb5..57075ee5b8 100644
> --- a/drivers/net/intel/iavf/iavf_tm.c
> +++ b/drivers/net/intel/iavf/iavf_tm.c
> @@ -867,15 +867,15 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
>  		}
>  		q_tc_mapping->tc[tm_node->tc].req.queue_count++;
>  
> +		q_bw->cfg[node_committed].queue_id = tm_node->id;
> +		q_bw->cfg[node_committed].tc = tm_node->tc;
>  		if (tm_node->shaper_profile) {
> -			q_bw->cfg[node_committed].queue_id = tm_node->id;
>  			q_bw->cfg[node_committed].shaper.peak =
>  			tm_node->shaper_profile->profile.peak.rate /
>  			1000 * IAVF_BITS_PER_BYTE;
>  			q_bw->cfg[node_committed].shaper.committed =
>  			tm_node->shaper_profile->profile.committed.rate /
>  			1000 * IAVF_BITS_PER_BYTE;
> -			q_bw->cfg[node_committed].tc = tm_node->tc;
>  		}
>  
>  		node_committed++;
> -- 
> 2.43.0
> 

[PATCH 3/3] net/iavf: fix crash in TM ops without QoS capability

[Dawid Wesierski]

The VF allocates qos_cap and initializes the TM lists only when the PF
grants VIRTCHNL_VF_OFFLOAD_QOS. The in-tree ice PF does not grant it.
On such a VF, node add, shaper profile add, capabilities get, and node
capabilities get dereference a NULL qos_cap, or insert into a list that
has no initialization. The application gets a segmentation fault from a
call such as rte_tm_capabilities_get().

Return -ENOTSUP from these operations when qos_cap is NULL. The other
TM operations only search the lists, or check VIRTCHNL_VF_OFFLOAD_QOS
already, so they do not need the check.

Fixes: 44d0a720a538 ("net/iavf: query QoS capabilities and set queue TC mapping")
Cc: stable@dpdk.org

Signed-off-by: Dawid Wesierski <dawid.wesierski@intel.com>
---
 drivers/net/intel/iavf/iavf_tm.c | 37 ++++++++++++++++++++++++++++++--
 1 file changed, 35 insertions(+), 2 deletions(-)

diff --git a/drivers/net/intel/iavf/iavf_tm.c b/drivers/net/intel/iavf/iavf_tm.c
index 57075ee5b8..07ba58f6f5 100644
--- a/drivers/net/intel/iavf/iavf_tm.c
+++ b/drivers/net/intel/iavf/iavf_tm.c
@@ -102,6 +102,18 @@ iavf_tm_conf_uninit(struct rte_eth_dev *dev)
 	vf->qtc_map = NULL;
 }
 
+/* qos_cap and the TM lists exist only if the PF grants VIRTCHNL_VF_OFFLOAD_QOS. */
+static int
+iavf_tm_qos_check(struct iavf_info *vf, struct rte_tm_error *error)
+{
+	if (vf->qos_cap != NULL)
+		return 0;
+
+	error->type = RTE_TM_ERROR_TYPE_CAPABILITIES;
+	error->message = "VF has no QoS capability";
+	return -ENOTSUP;
+}
+
 static inline struct iavf_tm_node *
 iavf_tm_node_search(struct rte_eth_dev *dev,
 		    uint32_t node_id, enum iavf_tm_node_type *node_type)
@@ -279,12 +291,18 @@ iavf_tm_node_add(struct rte_eth_dev *dev, uint32_t node_id,
 	struct iavf_tm_shaper_profile *shaper_profile = NULL;
 	struct iavf_tm_node *tm_node;
 	struct iavf_tm_node *parent_node;
-	uint16_t tc_nb = vf->qos_cap->num_elem;
+	uint16_t tc_nb;
 	int ret;
 
 	if (!params || !error)
 		return -EINVAL;
 
+	ret = iavf_tm_qos_check(vf, error);
+	if (ret)
+		return ret;
+
+	tc_nb = vf->qos_cap->num_elem;
+
 	/* if already committed */
 	if (vf->tm_conf.committed) {
 		error->type = RTE_TM_ERROR_TYPE_UNSPECIFIED;
@@ -524,6 +542,10 @@ iavf_shaper_profile_add(struct rte_eth_dev *dev,
 	if (!profile || !error)
 		return -EINVAL;
 
+	ret = iavf_tm_qos_check(vf, error);
+	if (ret)
+		return ret;
+
 	ret = iavf_shaper_profile_param_check(profile, error);
 	if (ret)
 		return ret;
@@ -588,11 +610,17 @@ iavf_tm_capabilities_get(struct rte_eth_dev *dev,
 			 struct rte_tm_error *error)
 {
 	struct iavf_info *vf = IAVF_DEV_PRIVATE_TO_VF(dev->data->dev_private);
-	uint16_t tc_nb = vf->qos_cap->num_elem;
+	uint16_t tc_nb;
+	int ret;
 
 	if (!cap || !error)
 		return -EINVAL;
 
+	ret = iavf_tm_qos_check(vf, error);
+	if (ret)
+		return ret;
+
+	tc_nb = vf->qos_cap->num_elem;
 	if (tc_nb > vf->vf_res->num_queue_pairs)
 		return -EINVAL;
 
@@ -744,10 +772,15 @@ iavf_node_capabilities_get(struct rte_eth_dev *dev,
 	enum iavf_tm_node_type node_type;
 	struct virtchnl_qos_cap_elem tc_cap;
 	struct iavf_tm_node *tm_node;
+	int ret;
 
 	if (!cap || !error)
 		return -EINVAL;
 
+	ret = iavf_tm_qos_check(vf, error);
+	if (ret)
+		return ret;
+
 	if (node_id == RTE_TM_NODE_ID_NULL) {
 		error->type = RTE_TM_ERROR_TYPE_NODE_ID;
 		error->message = "invalid node id";
-- 
2.43.0

---------------------------------------------------------------------
Intel Technology Poland sp. z o.o.
ul. Slowackiego 173 | 80-298 Gdansk | Sad Rejonowy Gdansk Polnoc | VII Wydzial Gospodarczy Krajowego Rejestru Sadowego - KRS 101882 | NIP 957-07-52-316 | Kapital zakladowy 200.000 PLN.
Spolka oswiadcza, ze posiada status duzego przedsiebiorcy w rozumieniu ustawy z dnia 8 marca 2013 r. o przeciwdzialaniu nadmiernym opoznieniom w transakcjach handlowych.

Ta wiadomosc wraz z zalacznikami jest przeznaczona dla okreslonego adresata i moze zawierac informacje poufne. W razie przypadkowego otrzymania tej wiadomosci, prosimy o powiadomienie nadawcy oraz trwale jej usuniecie; jakiekolwiek przegladanie lub rozpowszechnianie jest zabronione.
This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). If you are not the intended recipient, please contact the sender and delete all copies; any review or distribution by others is strictly prohibited.

Re: [PATCH 3/3] net/iavf: fix crash in TM ops without QoS capability

[Bruce Richardson]

On Wed, Oct 14, 2026 at 12:24:18PM +0000, Dawid Wesierski wrote:
> The VF allocates qos_cap and initializes the TM lists only when the PF
> grants VIRTCHNL_VF_OFFLOAD_QOS. The in-tree ice PF does not grant it.
> On such a VF, node add, shaper profile add, capabilities get, and node
> capabilities get dereference a NULL qos_cap, or insert into a list that
> has no initialization. The application gets a segmentation fault from a
> call such as rte_tm_capabilities_get().
> 
> Return -ENOTSUP from these operations when qos_cap is NULL. The other
> TM operations only search the lists, or check VIRTCHNL_VF_OFFLOAD_QOS
> already, so they do not need the check.
> 
> Fixes: 44d0a720a538 ("net/iavf: query QoS capabilities and set queue TC mapping")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Dawid Wesierski <dawid.wesierski@intel.com>
> ---
Acked-by: Bruce Richardson <bruce.richardson@intel.com>