[PATCH v2 net-next 0/3] net: hns3: some cleanups for hns3 driver

[PATCH v2 net-next 0/3] net: hns3: some cleanups for hns3 driver

[Jijie Shao]

Patch 1 sets msg->desc to NULL after kfree to avoid leaving a
dangling pointer in a struct that is reused across loop iterations.

Patch 2 adds the missing const qualifier to the reg parameter of
hclge_log_error(), which is never modified within the function.

Patch 3 uses the txqueue parameter passed by the ndo_tx_timeout
callback directly, instead of iterating all tx queues to find the
timed out one.

---
Changes in v2:
patch3:
    - Use h->kinfo.num_tqps for bounds check instead of
      ndev->num_tx_queues
    - Restore the netif_xmit_timeout_ms() check by making
      hns3_dump_timeout_queue() return bool and gating on
      its return value, so a cleared stall does not trigger
      a reset
    - Fold the bounds fix into this patch rather than tracking
      it as a separate bugfix, as the OOB has not been
      encountered in practice

v1: https://lore.kernel.org/all/20260804130933.880552-1-shaojijie@huawei.com/
---

Jian Shen (2):
  net: hns3: set msg->desc to NULL after kfree in hclge_query_reg_info()
  net: hns3: use txqueue parameter directly in ndo_tx_timeout

Jijie Shao (1):
  net: hns3: add missing const qualifier to hclge_log_error() reg
    parameter

 .../net/ethernet/hisilicon/hns3/hns3_enet.c   | 48 +++++++++----------
 .../hisilicon/hns3/hns3pf/hclge_err.c         |  3 +-
 2 files changed, 24 insertions(+), 27 deletions(-)


base-commit: 4fa4977a0d900f936bcae5cd2c510be5554e8dd6
-- 
2.33.0

[PATCH v2 net-next 1/3] net: hns3: set msg->desc to NULL after kfree in hclge_query_reg_info()

[Jijie Shao]

From: Jian Shen <shenjian15@huawei.com>

In hclge_query_reg_info(), msg->desc is freed by kfree(), but the
caller continues to use msg across loop iterations. Set msg->desc
to NULL to avoid leaving a dangling pointer in the reused struct.

Signed-off-by: Jian Shen <shenjian15@huawei.com>
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
Reviewed-by: Simon Horman <horms@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c
index dac051e798da..7e124e2c718d 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c
@@ -1592,6 +1592,7 @@ hclge_query_reg_info(struct hclge_dev *hdev,
 	}
 
 	kfree(msg->desc);
+	msg->desc = NULL;
 }
 
 static void hclge_query_reg_info_of_ssu(struct hclge_dev *hdev)
-- 
2.33.0

[PATCH v2 net-next 2/3] net: hns3: add missing const qualifier to hclge_log_error() reg parameter

[Jijie Shao]

The reg parameter of hclge_log_error() is never modified within the
function, but is declared as 'char *'. Callers pass const strings,
causing a compiler warning about discarding the 'const' qualifier.
Add the missing const to fix the warning.

Signed-off-by: Jijie Shao <shaojijie@huawei.com>
Reviewed-by: Simon Horman <horms@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c
index 7e124e2c718d..6093a60d257b 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c
@@ -1762,7 +1762,7 @@ static const struct hclge_hw_type_id hclge_hw_type_id_st[] = {
 	},
 };
 
-static void hclge_log_error(struct device *dev, char *reg,
+static void hclge_log_error(struct device *dev, const char *reg,
 			    const struct hclge_hw_error *err,
 			    u32 err_sts, unsigned long *reset_requests)
 {
-- 
2.33.0

[PATCH v2 net-next 3/3] net: hns3: use txqueue parameter directly in ndo_tx_timeout

[Jijie Shao]

From: Jian Shen <shenjian15@huawei.com>

The ndo_tx_timeout callback already provides the timed out txqueue
index. Use it directly instead of iterating all tx queues to find
the timed out one.

Use h->kinfo.num_tqps for the bounds check instead of
ndev->num_tx_queues, as the ring array is allocated with num_tqps
entries and num_tx_queues may be larger.  This issue has not been
encountered in practice, so it is folded into this cleanup rather
than tracked as a separate bugfix.

Signed-off-by: Jian Shen <shenjian15@huawei.com>
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
---
Changes in v2:
- Use h->kinfo.num_tqps for bounds check instead of
  ndev->num_tx_queues
- Restore the netif_xmit_timeout_ms() check by making
  hns3_dump_timeout_queue() return bool and gating on
  its return value, so a cleared stall does not trigger
  a reset
- Fold the bounds fix into this patch rather than tracking
  it as a separate bugfix, as the OOB has not been
  encountered in practice

v1: https://lore.kernel.org/all/20260804130933.880552-1-shaojijie@huawei.com/
---
 .../net/ethernet/hisilicon/hns3/hns3_enet.c   | 48 +++++++++----------
 1 file changed, 22 insertions(+), 26 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 6ecb32e28e79..47788be64be6 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -2825,32 +2825,28 @@ static int hns3_nic_change_mtu(struct net_device *netdev, int new_mtu)
 	return ret;
 }
 
-static int hns3_get_timeout_queue(struct net_device *ndev)
+static bool hns3_dump_timeout_queue(struct net_device *ndev,
+				    unsigned int txqueue)
 {
-	unsigned int i;
-
-	/* Find the stopped queue the same way the stack does */
-	for (i = 0; i < ndev->num_tx_queues; i++) {
-		unsigned int timedout_ms;
-		struct netdev_queue *q;
+	unsigned int timedout_ms;
+	struct netdev_queue *q;
 
-		q = netdev_get_tx_queue(ndev, i);
-		timedout_ms = netif_xmit_timeout_ms(q);
-		if (timedout_ms) {
+	q = netdev_get_tx_queue(ndev, txqueue);
+	timedout_ms = netif_xmit_timeout_ms(q);
+	if (timedout_ms) {
 #ifdef CONFIG_BQL
-			struct dql *dql = &q->dql;
+		struct dql *dql = &q->dql;
 
-			netdev_info(ndev, "DQL info last_cnt: %u, queued: %u, adj_limit: %u, completed: %u\n",
-				    dql->last_obj_cnt, dql->num_queued,
-				    dql->adj_limit, dql->num_completed);
+		netdev_info(ndev, "DQL info last_cnt: %u, queued: %u, adj_limit: %u, completed: %u\n",
+			    dql->last_obj_cnt, dql->num_queued,
+			    dql->adj_limit, dql->num_completed);
 #endif
-			netdev_info(ndev, "queue state: 0x%lx, delta msecs: %u\n",
-				    q->state, timedout_ms);
-			break;
-		}
+		netdev_info(ndev, "queue state: 0x%lx, delta msecs: %u\n",
+			    q->state, timedout_ms);
+		return true;
 	}
 
-	return i;
+	return false;
 }
 
 static void hns3_dump_queue_stats(struct net_device *ndev,
@@ -2900,15 +2896,15 @@ static void hns3_dump_queue_reg(struct net_device *ndev,
 				      HNS3_RING_TX_RING_EBD_OFFSET_REG));
 }
 
-static bool hns3_get_tx_timeo_queue_info(struct net_device *ndev)
+static bool hns3_get_tx_timeo_queue_info(struct net_device *ndev,
+					 unsigned int txqueue)
 {
 	struct hns3_nic_priv *priv = netdev_priv(ndev);
 	struct hnae3_handle *h = hns3_get_handle(ndev);
 	struct hns3_enet_ring *tx_ring;
-	u32 timeout_queue;
 
-	timeout_queue = hns3_get_timeout_queue(ndev);
-	if (timeout_queue >= ndev->num_tx_queues) {
+	if (txqueue >= h->kinfo.num_tqps ||
+	    !hns3_dump_timeout_queue(ndev, txqueue)) {
 		netdev_info(ndev,
 			    "no netdev TX timeout queue found, timeout count: %llu\n",
 			    priv->tx_timeout_count);
@@ -2917,8 +2913,8 @@ static bool hns3_get_tx_timeo_queue_info(struct net_device *ndev)
 
 	priv->tx_timeout_count++;
 
-	tx_ring = &priv->ring[timeout_queue];
-	hns3_dump_queue_stats(ndev, tx_ring, timeout_queue);
+	tx_ring = &priv->ring[txqueue];
+	hns3_dump_queue_stats(ndev, tx_ring, txqueue);
 
 	/* When mac received many pause frames continuous, it's unable to send
 	 * packets, which may cause tx timeout
@@ -2941,7 +2937,7 @@ static void hns3_nic_net_timeout(struct net_device *ndev, unsigned int txqueue)
 	struct hns3_nic_priv *priv = netdev_priv(ndev);
 	struct hnae3_handle *h = priv->ae_handle;
 
-	if (!hns3_get_tx_timeo_queue_info(ndev))
+	if (!hns3_get_tx_timeo_queue_info(ndev, txqueue))
 		return;
 
 	/* request the reset, and let the hclge to determine
-- 
2.33.0

Re: [PATCH v2 net-next 3/3] net: hns3: use txqueue parameter directly in ndo_tx_timeout

[Simon Horman]

On Fri, Aug 07, 2026 at 05:54:35PM +0800, Jijie Shao wrote:
> From: Jian Shen <shenjian15@huawei.com>
> 
> The ndo_tx_timeout callback already provides the timed out txqueue
> index. Use it directly instead of iterating all tx queues to find
> the timed out one.
> 
> Use h->kinfo.num_tqps for the bounds check instead of
> ndev->num_tx_queues, as the ring array is allocated with num_tqps
> entries and num_tx_queues may be larger.  This issue has not been
> encountered in practice, so it is folded into this cleanup rather
> than tracked as a separate bugfix.
> 
> Signed-off-by: Jian Shen <shenjian15@huawei.com>
> Signed-off-by: Jijie Shao <shaojijie@huawei.com>
> ---
> Changes in v2:
> - Use h->kinfo.num_tqps for bounds check instead of
>   ndev->num_tx_queues
> - Restore the netif_xmit_timeout_ms() check by making
>   hns3_dump_timeout_queue() return bool and gating on
>   its return value, so a cleared stall does not trigger
>   a reset
> - Fold the bounds fix into this patch rather than tracking
>   it as a separate bugfix, as the OOB has not been
>   encountered in practice
> 
> v1: https://lore.kernel.org/all/20260804130933.880552-1-shaojijie@huawei.com/

Thanks for the updates.

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH v2 net-next 0/3] net: hns3: some cleanups for hns3 driver

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net-next.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Fri, 7 Aug 2026 17:54:32 +0800 you wrote:
> Patch 1 sets msg->desc to NULL after kfree to avoid leaving a
> dangling pointer in a struct that is reused across loop iterations.
> 
> Patch 2 adds the missing const qualifier to the reg parameter of
> hclge_log_error(), which is never modified within the function.
> 
> Patch 3 uses the txqueue parameter passed by the ndo_tx_timeout
> callback directly, instead of iterating all tx queues to find the
> timed out one.
> 
> [...]

Here is the summary with links:
  - [v2,net-next,1/3] net: hns3: set msg->desc to NULL after kfree in hclge_query_reg_info()
    https://git.kernel.org/netdev/net-next/c/4f20c628b62e
  - [v2,net-next,2/3] net: hns3: add missing const qualifier to hclge_log_error() reg parameter
    https://git.kernel.org/netdev/net-next/c/b8f554e13899
  - [v2,net-next,3/3] net: hns3: use txqueue parameter directly in ndo_tx_timeout
    https://git.kernel.org/netdev/net-next/c/f57b277e8b6f

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html