Re: [PATCH net-next v5 10/15] iavf: use new opcodes to request more than 16 queues

[Petr Oros <poros@redhat.com>]

On Tue, 10 Nov 2026 15:07:19 +0100, Przemek Kitszel wrote:
> +		adapter->rss_key_size = adapter->vf_res->rss_key_size;
> +		adapter->rss_lut_size = adapter->vf_res->rss_lut_size;
> +		iavf_init_rss(adapter);

This divides by zero when a VF comes back from a reset that timed out
and the PF reports a different rss_lut_size than before.
iavf_disable_vf() leaves num_active_queues at 0, and
iavf_fill_rss_lut() uses it as the modulus:

  iavf 0000:04:01.0: Reset never finished (0)
  iavf 0000:04:01.0: Reset task did not complete, VF disabled
  iavf 0000:04:01.0: Hardware came out of reset. Attempting reinit.
  Oops: divide error: 0000 [#1] SMP KASAN PTI
  Workqueue: iavf iavf_watchdog_task [iavf]
  RIP: 0010:iavf_fill_rss_lut+0x14a/0x2c0 [iavf]
  Call Trace:
   iavf_init_rss+0xfa/0x1d0 [iavf]
   iavf_parse_vf_resource_msg+0x7d6/0xeb0 [iavf]
   iavf_watchdog_task+0x8c8/0x2e30 [iavf]

Reproducer on an E810, two VFs of 0000:04:00.0 bound to iavf on the
host. Run a PFR every 7 seconds

  ethtool --reset enp4s0f0np0 flags 0x1e

and meanwhile, once a second,

  devlink resource set pci/0000:04:00.0 path rss/lut_512 size 1
  devlink resource set pci/0000:04:01.0 path rss/lut_512 size 1
  devlink resource set pci/0000:04:01.1 path rss/lut_512 size $((i % 2))
  devlink resource set pci/0000:04:00.0 path rss/lut_512 size 0

with the LUT of the first VF released again on every fourth round.
One of the PFRs takes long enough for both VFs to give up on their
reset, and both oops on reinit, as the PFR also took their 512 entry
LUT away.

Sashiko reported this for v4 ("iavf: divide-by-zero in
iavf_fill_rss_lut() on reinit after iavf_disable_vf()"), it is not in
the v5 changelog.

Regards,
Petr