hv_netvsc: user-configured RSS indirection table is zeroed on MTU change

hv_netvsc: user-configured RSS indirection table is zeroed on MTU change

[Amir Boussejra]

Hi,

On Azure/Hyper-V, any MTU change on an hv_netvsc interface silently zeroes a
user-configured RSS indirection table, so all RX traffic lands on ring 0.

Reproducer in our case (any multi-queue hv_netvsc NIC, ethtool and ip only):

```
  ethtool -X eth0 hkey $SOME_KEY equal 4
     ethtool -x eth0             # See conf
     ip link set eth0 mtu 1600     # must differ from the current MTU
     ethtool -x eth0               # all zeros in indirection table
```

With the table left to the driver (ethtool -X eth0 default) the same MTU
change is harmless: the table comes back correctly spread.

Confirmed with kprobes on 6.12.90 - these all fire on the MTU write:

```
     netvsc_change_mtu
     netvsc_detach
     rndis_filter_device_remove
     netvsc_attach
     rndis_filter_device_add
```

[`netvsc_change_mtu()`](https://github.com/torvalds/linux/blob/v6.12/drivers/net/hyperv/netvsc_drv.c#L1209)

An MTU change re-creates the device:
[detach](https://github.com/torvalds/linux/blob/v6.12/drivers/net/hyperv/netvsc_drv.c#L1233), 
then
[attach](https://github.com/torvalds/linux/blob/v6.12/drivers/net/hyperv/netvsc_drv.c#L1239).

The detach [frees the RSS indirection 
table](https://github.com/torvalds/linux/blob/v6.12/drivers/net/hyperv/rndis_filter.c#L1622)
(`rndis_filter_device_remove()`), and the attach
[allocates it 
zeroed](https://github.com/torvalds/linux/blob/v6.12/drivers/net/hyperv/rndis_filter.c#L1557)
with `kcalloc()` and refills it only if
[`(!netif_is_rxfh_configured(net))`](https://github.com/torvalds/linux/blob/v6.12/drivers/net/hyperv/rndis_filter.c#L1572)
(`rndis_filter_device_add()`).

Re: hv_netvsc: user-configured RSS indirection table is zeroed on MTU change

[Aditya Garg]

On 29-10-2026 14:40, Amir Boussejra wrote:
> Hi,
> 
> On Azure/Hyper-V, any MTU change on an hv_netvsc interface silently 
> zeroes a
> user-configured RSS indirection table, so all RX traffic lands on ring 0.
> 
> Reproducer in our case (any multi-queue hv_netvsc NIC, ethtool and ip 
> only):
> 
> ```
>   ethtool -X eth0 hkey $SOME_KEY equal 4
>      ethtool -x eth0             # See conf
>      ip link set eth0 mtu 1600     # must differ from the current MTU
>      ethtool -x eth0               # all zeros in indirection table
> ```
> 
> With the table left to the driver (ethtool -X eth0 default) the same MTU
> change is harmless: the table comes back correctly spread.
> 
> Confirmed with kprobes on 6.12.90 - these all fire on the MTU write:
> 
> ```
>      netvsc_change_mtu
>      netvsc_detach
>      rndis_filter_device_remove
>      netvsc_attach
>      rndis_filter_device_add
> ```
> 
> [`netvsc_change_mtu()`](https://github.com/torvalds/linux/blob/v6.12/ 
> drivers/net/hyperv/netvsc_drv.c#L1209)
> 
> An MTU change re-creates the device:
> [detach](https://github.com/torvalds/linux/blob/v6.12/drivers/net/ 
> hyperv/netvsc_drv.c#L1233), then
> [attach](https://github.com/torvalds/linux/blob/v6.12/drivers/net/ 
> hyperv/netvsc_drv.c#L1239).
> 
> The detach [frees the RSS indirection table](https://github.com/ 
> torvalds/linux/blob/v6.12/drivers/net/hyperv/rndis_filter.c#L1622)
> (`rndis_filter_device_remove()`), and the attach
> [allocates it zeroed](https://github.com/torvalds/linux/blob/v6.12/ 
> drivers/net/hyperv/rndis_filter.c#L1557)
> with `kcalloc()` and refills it only if
> [`(!netif_is_rxfh_configured(net))`](https://github.com/torvalds/linux/ 
> blob/v6.12/drivers/net/hyperv/rndis_filter.c#L1572)
> (`rndis_filter_device_add()`).
> 
> 


Hi Amir,
Thanks for reporting this bug
I'll post a fix for this and notify here as well

Regards,
Aditya