* [PATCH net 1/2] ice: move ice_vsi_realloc_stat_arrays() up
2026-08-12 20:18 [PATCH net 0/2][pull request] Intel Wired LAN Driver Updates 2026-08-12 (ice) Przemek Kitszel
@ 2026-08-12 20:18 ` Przemek Kitszel
2026-08-12 20:18 ` [PATCH net v2 2/2] ice: fix stats array overflow via proper realloc Przemek Kitszel
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: Przemek Kitszel @ 2026-08-12 20:18 UTC (permalink / raw)
To: netdev, Jakub Kicinski
Cc: intel-wired-lan, Tony Nguyen, Przemek Kitszel, Andrew Lunn,
David S. Miller, Eric Dumazet, Paolo Abeni, Michal Schmidt,
Marcin Szycik, Aleksandr Loktionov, Simon Horman,
Rafal Romanowski
Move ice_vsi_realloc_stat_arrays() up, to allow calling it from
ice_vsi_cfg_def() by the next commit.
Fix kdoc for touched code. One line break removed, "int i" scope
minimized to the loop, no changes otherwise.
Reviewed-by: Marcin Szycik <marcin.szycik@linux.intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
---
changelog:
add collected tags from IWL's v3
---
drivers/net/ethernet/intel/ice/ice_lib.c | 119 +++++++++++------------
1 file changed, 59 insertions(+), 60 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c
index 8cdc4fda89e9..e48ee5940f17 100644
--- a/drivers/net/ethernet/intel/ice/ice_lib.c
+++ b/drivers/net/ethernet/intel/ice/ice_lib.c
@@ -2303,6 +2303,65 @@ static int ice_vsi_cfg_tc_lan(struct ice_pf *pf, struct ice_vsi *vsi)
return 0;
}
+/**
+ * ice_vsi_realloc_stat_arrays - Frees unused stat structures or alloc new ones
+ * @vsi: VSI pointer
+ * Return: 0 on success or -ENOMEM on allocation failure.
+ */
+static int ice_vsi_realloc_stat_arrays(struct ice_vsi *vsi)
+{
+ u16 req_txq = vsi->req_txq ? vsi->req_txq : vsi->alloc_txq;
+ u16 req_rxq = vsi->req_rxq ? vsi->req_rxq : vsi->alloc_rxq;
+ struct ice_ring_stats **tx_ring_stats;
+ struct ice_ring_stats **rx_ring_stats;
+ struct ice_vsi_stats *vsi_stat;
+ struct ice_pf *pf = vsi->back;
+ u16 prev_txq = vsi->alloc_txq;
+ u16 prev_rxq = vsi->alloc_rxq;
+
+ vsi_stat = pf->vsi_stats[vsi->idx];
+
+ if (req_txq < prev_txq) {
+ for (int i = req_txq; i < prev_txq; i++) {
+ if (vsi_stat->tx_ring_stats[i]) {
+ kfree_rcu(vsi_stat->tx_ring_stats[i], rcu);
+ WRITE_ONCE(vsi_stat->tx_ring_stats[i], NULL);
+ }
+ }
+ }
+
+ tx_ring_stats = vsi_stat->tx_ring_stats;
+ vsi_stat->tx_ring_stats =
+ krealloc_array(vsi_stat->tx_ring_stats, req_txq,
+ sizeof(*vsi_stat->tx_ring_stats),
+ GFP_KERNEL | __GFP_ZERO);
+ if (!vsi_stat->tx_ring_stats) {
+ vsi_stat->tx_ring_stats = tx_ring_stats;
+ return -ENOMEM;
+ }
+
+ if (req_rxq < prev_rxq) {
+ for (int i = req_rxq; i < prev_rxq; i++) {
+ if (vsi_stat->rx_ring_stats[i]) {
+ kfree_rcu(vsi_stat->rx_ring_stats[i], rcu);
+ WRITE_ONCE(vsi_stat->rx_ring_stats[i], NULL);
+ }
+ }
+ }
+
+ rx_ring_stats = vsi_stat->rx_ring_stats;
+ vsi_stat->rx_ring_stats =
+ krealloc_array(vsi_stat->rx_ring_stats, req_rxq,
+ sizeof(*vsi_stat->rx_ring_stats),
+ GFP_KERNEL | __GFP_ZERO);
+ if (!vsi_stat->rx_ring_stats) {
+ vsi_stat->rx_ring_stats = rx_ring_stats;
+ return -ENOMEM;
+ }
+
+ return 0;
+}
+
/**
* ice_vsi_cfg_def - configure default VSI based on the type
* @vsi: pointer to VSI
@@ -3011,66 +3070,6 @@ ice_vsi_rebuild_set_coalesce(struct ice_vsi *vsi,
}
}
-/**
- * ice_vsi_realloc_stat_arrays - Frees unused stat structures or alloc new ones
- * @vsi: VSI pointer
- */
-static int
-ice_vsi_realloc_stat_arrays(struct ice_vsi *vsi)
-{
- u16 req_txq = vsi->req_txq ? vsi->req_txq : vsi->alloc_txq;
- u16 req_rxq = vsi->req_rxq ? vsi->req_rxq : vsi->alloc_rxq;
- struct ice_ring_stats **tx_ring_stats;
- struct ice_ring_stats **rx_ring_stats;
- struct ice_vsi_stats *vsi_stat;
- struct ice_pf *pf = vsi->back;
- u16 prev_txq = vsi->alloc_txq;
- u16 prev_rxq = vsi->alloc_rxq;
- int i;
-
- vsi_stat = pf->vsi_stats[vsi->idx];
-
- if (req_txq < prev_txq) {
- for (i = req_txq; i < prev_txq; i++) {
- if (vsi_stat->tx_ring_stats[i]) {
- kfree_rcu(vsi_stat->tx_ring_stats[i], rcu);
- WRITE_ONCE(vsi_stat->tx_ring_stats[i], NULL);
- }
- }
- }
-
- tx_ring_stats = vsi_stat->tx_ring_stats;
- vsi_stat->tx_ring_stats =
- krealloc_array(vsi_stat->tx_ring_stats, req_txq,
- sizeof(*vsi_stat->tx_ring_stats),
- GFP_KERNEL | __GFP_ZERO);
- if (!vsi_stat->tx_ring_stats) {
- vsi_stat->tx_ring_stats = tx_ring_stats;
- return -ENOMEM;
- }
-
- if (req_rxq < prev_rxq) {
- for (i = req_rxq; i < prev_rxq; i++) {
- if (vsi_stat->rx_ring_stats[i]) {
- kfree_rcu(vsi_stat->rx_ring_stats[i], rcu);
- WRITE_ONCE(vsi_stat->rx_ring_stats[i], NULL);
- }
- }
- }
-
- rx_ring_stats = vsi_stat->rx_ring_stats;
- vsi_stat->rx_ring_stats =
- krealloc_array(vsi_stat->rx_ring_stats, req_rxq,
- sizeof(*vsi_stat->rx_ring_stats),
- GFP_KERNEL | __GFP_ZERO);
- if (!vsi_stat->rx_ring_stats) {
- vsi_stat->rx_ring_stats = rx_ring_stats;
- return -ENOMEM;
- }
-
- return 0;
-}
-
/**
* ice_vsi_rebuild - Rebuild VSI after reset
* @vsi: VSI to be rebuild
--
2.54.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH net v2 2/2] ice: fix stats array overflow via proper realloc
2026-08-12 20:18 [PATCH net 0/2][pull request] Intel Wired LAN Driver Updates 2026-08-12 (ice) Przemek Kitszel
2026-08-12 20:18 ` [PATCH net 1/2] ice: move ice_vsi_realloc_stat_arrays() up Przemek Kitszel
@ 2026-08-12 20:18 ` Przemek Kitszel
2026-08-17 20:50 ` [Intel-wired-lan] " Jakub Kicinski
2026-08-17 15:55 ` [PATCH net 0/2][pull request] Intel Wired LAN Driver Updates 2026-08-12 (ice) Tony Nguyen
2026-08-17 20:51 ` Jakub Kicinski
3 siblings, 1 reply; 6+ messages in thread
From: Przemek Kitszel @ 2026-08-12 20:18 UTC (permalink / raw)
To: netdev, Jakub Kicinski
Cc: intel-wired-lan, Tony Nguyen, Przemek Kitszel, Andrew Lunn,
David S. Miller, Eric Dumazet, Paolo Abeni, Michal Schmidt,
Marcin Szycik, Aleksandr Loktionov, Simon Horman,
Rafal Romanowski
Integrate ice_vsi_alloc_stat_arrays() with realloc variant.
Instead of keeping two functions for stat arrays allocation, change the
ice_vsi_realloc_stat_arrays() to handle initial condition (no vsi_stat
entry) and replace ice_vsi_alloc_stat_arrays() by the more generic
ice_vsi_realloc_stat_arrays().
Note that VSIs of ICE_VSI_CHNL type are ignored in realloc variant as they
were in the replaced ice_vsi_alloc_stat_arrays().
This is a fix for stats array overflow that occurs when VF is given more
queues (an operation that will be more frequent, and by bigger increase,
when we will merge my "XLVF" series).
Apply minor refactoring inside ice_vsi_realloc_stat_arrays() to avoid
mixing req/alloc variables used in different user paths. Also drop one
callsite to avoid some duplication.
Splat for increasing number of queues thanks to Michal Schmidt:
KASAN detects the bug:
==================================================================
BUG: KASAN: slab-out-of-bounds in ice_vsi_alloc_ring_stats+0x385/0x4a0 [ice]
Read of size 8 at addr ffff88810affea60 by task kworker/u131:7/221
CPU: 24 UID: 0 PID: 221 Comm: kworker/u131:7 Not tainted 7.1.0-rc1+ #1 PREEMPT(lazy)
...
Workqueue: ice ice_service_task [ice]
Call Trace:
<TASK>
...
kasan_report+0xd7/0x120
ice_vsi_alloc_ring_stats+0x385/0x4a0 [ice]
ice_vsi_cfg_def+0x12e2/0x2060 [ice]
ice_vsi_cfg+0xb5/0x3c0 [ice]
ice_reset_vf+0x858/0xf80 [ice]
ice_vc_request_qs_msg+0x1da/0x290 [ice]
ice_vc_process_vf_msg+0xb15/0x1430 [ice]
__ice_clean_ctrlq+0x70d/0x9d0 [ice]
ice_service_task+0x840/0xf20 [ice]
process_one_work+0x690/0xff0
worker_thread+0x4d9/0xd20
kthread+0x322/0x410
ret_from_fork+0x332/0x660
ret_from_fork_asm+0x1a/0x30
</TASK>
Allocated by task 2439:
kasan_save_stack+0x1c/0x40
kasan_save_track+0x10/0x30
__kasan_kmalloc+0x96/0xb0
__kmalloc_noprof+0x1d8/0x580
ice_vsi_cfg_def+0x115c/0x2060 [ice]
ice_vsi_cfg+0xb5/0x3c0 [ice]
ice_vsi_setup+0x180/0x320 [ice]
ice_start_vfs+0x1f3/0x590 [ice]
ice_ena_vfs+0x66d/0x798 [ice]
ice_sriov_configure.cold+0xe4/0x121 [ice]
sriov_numvfs_store+0x279/0x480
kernfs_fop_write_iter+0x331/0x4f0
vfs_write+0x4c4/0xe40
ksys_write+0x10c/0x240
do_syscall_64+0xd9/0x650
entry_SYSCALL_64_after_hwframe+0x76/0x7e
The buggy address belongs to the object at ffff88810affea40
which belongs to the cache kmalloc-32 of size 32
The buggy address is located 0 bytes to the right of
allocated 32-byte region [ffff88810affea40, ffff88810affea60)
Fixes: 2a2cb4c6c181 ("ice: replace ice_vf_recreate_vsi() with ice_vf_reconfig_vsi()")
Closes: https://redhat.atlassian.net/browse/RHEL-164321
Reviewed-by: Marcin Szycik <marcin.szycik@linux.intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
---
This is an alternative to the fix [1] by Michal Schmidt, which were
blocked due to AI feedback. My fix was already developed before Michal's,
just not public back then. We have agreed to go on with my version.
[1] https://lore.kernel.org/netdev/20260520183501.3360810-3-anthony.l.nguyen@intel.com
v0 - previous "Intel Wired LAN pull request":
https://lore.kernel.org/netdev/20260804222205.1580328-7-anthony.l.nguyen@intel.com
v1 changes:
(Sashiko):
* refactor the function and usage in terms of req_tx/alloc_tx, to avoid
bounding by different variable for different user-paths (ditto for
*rx) - also consolidate to only one callsite
* collect missing tags from IWL v3
---
drivers/net/ethernet/intel/ice/ice.h | 2 +
drivers/net/ethernet/intel/ice/ice_lib.c | 100 ++++++++---------------
2 files changed, 37 insertions(+), 65 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h
index fc91b6665f90..83da5ba6eeb1 100644
--- a/drivers/net/ethernet/intel/ice/ice.h
+++ b/drivers/net/ethernet/intel/ice/ice.h
@@ -328,6 +328,8 @@ enum ice_vsi_state {
struct ice_vsi_stats {
struct ice_ring_stats **tx_ring_stats; /* Tx ring stats array */
struct ice_ring_stats **rx_ring_stats; /* Rx ring stats array */
+ u16 tx_ring_stats_len;
+ u16 rx_ring_stats_len;
};
/* struct that defines a VSI, associated with a dev */
diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c
index e48ee5940f17..420e72df7f5e 100644
--- a/drivers/net/ethernet/intel/ice/ice_lib.c
+++ b/drivers/net/ethernet/intel/ice/ice_lib.c
@@ -338,7 +338,6 @@ static void ice_vsi_free_stats(struct ice_vsi *vsi)
{
struct ice_vsi_stats *vsi_stat;
struct ice_pf *pf = vsi->back;
- int i;
if (vsi->type == ICE_VSI_CHNL)
return;
@@ -349,14 +348,14 @@ static void ice_vsi_free_stats(struct ice_vsi *vsi)
if (!vsi_stat)
return;
- ice_for_each_alloc_txq(vsi, i) {
+ for (int i = 0; i < vsi_stat->tx_ring_stats_len; i++) {
if (vsi_stat->tx_ring_stats[i]) {
kfree_rcu(vsi_stat->tx_ring_stats[i], rcu);
WRITE_ONCE(vsi_stat->tx_ring_stats[i], NULL);
}
}
- ice_for_each_alloc_rxq(vsi, i) {
+ for (int i = 0; i < vsi_stat->rx_ring_stats_len; i++) {
if (vsi_stat->rx_ring_stats[i]) {
kfree_rcu(vsi_stat->rx_ring_stats[i], rcu);
WRITE_ONCE(vsi_stat->rx_ring_stats[i], NULL);
@@ -513,51 +512,6 @@ static irqreturn_t ice_msix_clean_rings(int __always_unused irq, void *data)
return IRQ_HANDLED;
}
-/**
- * ice_vsi_alloc_stat_arrays - Allocate statistics arrays
- * @vsi: VSI pointer
- */
-static int ice_vsi_alloc_stat_arrays(struct ice_vsi *vsi)
-{
- struct ice_vsi_stats *vsi_stat;
- struct ice_pf *pf = vsi->back;
-
- if (vsi->type == ICE_VSI_CHNL)
- return 0;
- if (!pf->vsi_stats)
- return -ENOENT;
-
- if (pf->vsi_stats[vsi->idx])
- /* realloc will happen in rebuild path */
- return 0;
-
- vsi_stat = kzalloc_obj(*vsi_stat);
- if (!vsi_stat)
- return -ENOMEM;
-
- vsi_stat->tx_ring_stats =
- kzalloc_objs(*vsi_stat->tx_ring_stats, vsi->alloc_txq);
- if (!vsi_stat->tx_ring_stats)
- goto err_alloc_tx;
-
- vsi_stat->rx_ring_stats =
- kzalloc_objs(*vsi_stat->rx_ring_stats, vsi->alloc_rxq);
- if (!vsi_stat->rx_ring_stats)
- goto err_alloc_rx;
-
- pf->vsi_stats[vsi->idx] = vsi_stat;
-
- return 0;
-
-err_alloc_rx:
- kfree(vsi_stat->rx_ring_stats);
-err_alloc_tx:
- kfree(vsi_stat->tx_ring_stats);
- kfree(vsi_stat);
- pf->vsi_stats[vsi->idx] = NULL;
- return -ENOMEM;
-}
-
/**
* ice_vsi_alloc_def - set default values for already allocated VSI
* @vsi: ptr to VSI
@@ -2310,56 +2264,76 @@ static int ice_vsi_cfg_tc_lan(struct ice_pf *pf, struct ice_vsi *vsi)
*/
static int ice_vsi_realloc_stat_arrays(struct ice_vsi *vsi)
{
- u16 req_txq = vsi->req_txq ? vsi->req_txq : vsi->alloc_txq;
- u16 req_rxq = vsi->req_rxq ? vsi->req_rxq : vsi->alloc_rxq;
struct ice_ring_stats **tx_ring_stats;
struct ice_ring_stats **rx_ring_stats;
struct ice_vsi_stats *vsi_stat;
struct ice_pf *pf = vsi->back;
- u16 prev_txq = vsi->alloc_txq;
- u16 prev_rxq = vsi->alloc_rxq;
+ u16 new_txq = vsi->alloc_txq;
+ u16 new_rxq = vsi->alloc_rxq;
+ u16 prev_txq, prev_rxq;
+
+ if (vsi->type == ICE_VSI_CHNL)
+ return 0;
vsi_stat = pf->vsi_stats[vsi->idx];
+ if (!vsi_stat) {
+ vsi_stat = kzalloc_obj(*vsi_stat);
+ if (!vsi_stat)
+ return -ENOMEM;
+ }
- if (req_txq < prev_txq) {
- for (int i = req_txq; i < prev_txq; i++) {
+ prev_txq = vsi_stat->tx_ring_stats_len;
+ if (new_txq < prev_txq) {
+ for (int i = new_txq; i < prev_txq; i++) {
if (vsi_stat->tx_ring_stats[i]) {
kfree_rcu(vsi_stat->tx_ring_stats[i], rcu);
WRITE_ONCE(vsi_stat->tx_ring_stats[i], NULL);
}
}
}
tx_ring_stats = vsi_stat->tx_ring_stats;
vsi_stat->tx_ring_stats =
- krealloc_array(vsi_stat->tx_ring_stats, req_txq,
+ krealloc_array(vsi_stat->tx_ring_stats, new_txq,
sizeof(*vsi_stat->tx_ring_stats),
GFP_KERNEL | __GFP_ZERO);
if (!vsi_stat->tx_ring_stats) {
vsi_stat->tx_ring_stats = tx_ring_stats;
- return -ENOMEM;
+ goto err_free_partial_vsi_stat;
}
+ vsi_stat->tx_ring_stats_len = new_txq;
- if (req_rxq < prev_rxq) {
- for (int i = req_rxq; i < prev_rxq; i++) {
+ prev_rxq = vsi_stat->rx_ring_stats_len;
+ if (new_rxq < prev_rxq) {
+ for (int i = new_rxq; i < prev_rxq; i++) {
if (vsi_stat->rx_ring_stats[i]) {
kfree_rcu(vsi_stat->rx_ring_stats[i], rcu);
WRITE_ONCE(vsi_stat->rx_ring_stats[i], NULL);
}
}
}
rx_ring_stats = vsi_stat->rx_ring_stats;
vsi_stat->rx_ring_stats =
- krealloc_array(vsi_stat->rx_ring_stats, req_rxq,
+ krealloc_array(vsi_stat->rx_ring_stats, new_rxq,
sizeof(*vsi_stat->rx_ring_stats),
GFP_KERNEL | __GFP_ZERO);
if (!vsi_stat->rx_ring_stats) {
vsi_stat->rx_ring_stats = rx_ring_stats;
- return -ENOMEM;
+ goto err_free_partial_vsi_stat;
}
+ vsi_stat->rx_ring_stats_len = new_rxq;
+ pf->vsi_stats[vsi->idx] = vsi_stat;
return 0;
+
+err_free_partial_vsi_stat:
+ if (!pf->vsi_stats[vsi->idx]) {
+ /* vsi_stat was not visible before current alloc attempt */
+ kfree(vsi_stat->tx_ring_stats);
+ kfree(vsi_stat);
+ }
+ return -ENOMEM;
}
/**
@@ -2379,7 +2353,7 @@ static int ice_vsi_cfg_def(struct ice_vsi *vsi)
return ret;
/* allocate memory for Tx/Rx ring stat pointers */
- ret = ice_vsi_alloc_stat_arrays(vsi);
+ ret = ice_vsi_realloc_stat_arrays(vsi);
if (ret)
goto unroll_vsi_alloc;
@@ -3097,10 +3071,6 @@ int ice_vsi_rebuild(struct ice_vsi *vsi, u32 vsi_flags)
mutex_lock(&vsi->xdp_state_lock);
- ret = ice_vsi_realloc_stat_arrays(vsi);
- if (ret)
- goto unlock;
-
ice_vsi_decfg(vsi);
ret = ice_vsi_cfg_def(vsi);
if (ret)
--
2.54.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [Intel-wired-lan] [PATCH net v2 2/2] ice: fix stats array overflow via proper realloc
2026-08-12 20:18 ` [PATCH net v2 2/2] ice: fix stats array overflow via proper realloc Przemek Kitszel
@ 2026-08-17 20:50 ` Jakub Kicinski
0 siblings, 0 replies; 6+ messages in thread
From: Jakub Kicinski @ 2026-08-17 20:50 UTC (permalink / raw)
To: przemyslaw.kitszel
Cc: Jakub Kicinski, netdev, rafal.romanowski, aleksandr.loktionov,
andrew+netdev, edumazet, marcin.szycik, anthony.l.nguyen, horms,
intel-wired-lan, pabeni, davem
This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
---
ice: fix stats array overflow via proper realloc
This patch removes ice_vsi_alloc_stat_arrays() and makes
ice_vsi_realloc_stat_arrays() handle the initial (no vsi_stat) case, tracking
the array sizes in the new tx_ring_stats_len / rx_ring_stats_len fields. The
single remaining call site is in ice_vsi_cfg_def(), and the call in
ice_vsi_rebuild() is dropped.
Closes: https://redhat.atlassian.net/browse/RHEL-164321
> diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c
> index e48ee5940f17..420e72df7f5e 100644
> --- a/drivers/net/ethernet/intel/ice/ice_lib.c
> +++ b/drivers/net/ethernet/intel/ice/ice_lib.c
[ ... ]
> @@ -2379,7 +2353,7 @@ static int ice_vsi_cfg_def(struct ice_vsi *vsi)
> return ret;
>
> /* allocate memory for Tx/Rx ring stat pointers */
> - ret = ice_vsi_alloc_stat_arrays(vsi);
> + ret = ice_vsi_realloc_stat_arrays(vsi);
> if (ret)
> goto unroll_vsi_alloc;
>
> @@ -3097,10 +3071,6 @@ int ice_vsi_rebuild(struct ice_vsi *vsi, u32 vsi_flags)
>
> mutex_lock(&vsi->xdp_state_lock);
>
> - ret = ice_vsi_realloc_stat_arrays(vsi);
> - if (ret)
> - goto unlock;
> -
> ice_vsi_decfg(vsi);
> ret = ice_vsi_cfg_def(vsi);
> if (ret)
[Severity: Low]
Does moving the ice_vsi_realloc_stat_arrays() call change what happens when
the stat array allocation fails during a rebuild?
Before this patch, ice_vsi_rebuild() did the realloc before
ice_vsi_decfg(), so a krealloc_array() failure returned -ENOMEM with the VSI
still fully configured:
ret = ice_vsi_realloc_stat_arrays(vsi);
if (ret)
goto unlock;
ice_vsi_decfg(vsi);
Now the only call site is inside ice_vsi_cfg_def(), which runs after
ice_vsi_decfg(), so an -ENOMEM there unwinds via unroll_vsi_alloc and is
propagated out of ice_vsi_rebuild() with the queues, vectors and rings
already released.
For the ethtool -L path that leaves ice_vsi_recfg_qs() in ice_main.c with
only this recovery:
rebuild_err:
dev_err(ice_pf_to_dev(pf), "Error during VSI rebuild: %d. Unload and reload the driver.\n",
err);
The same outcome was already reachable pre-patch through the other
allocations in ice_vsi_cfg_def() (ice_vsi_alloc_def(),
ice_vsi_alloc_q_vectors(), ice_vsi_alloc_rings(),
ice_vsi_alloc_ring_stats()), so this adds one more allocation to an
already-destructive region rather than a new failure mode.
The commit message describes the move only as:
Also drop one callsite to avoid some duplication.
Could it also mention that the previously non-destructive failure path for
this allocation is gone?
--
pw-bot: cr
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net 0/2][pull request] Intel Wired LAN Driver Updates 2026-08-12 (ice)
2026-08-12 20:18 [PATCH net 0/2][pull request] Intel Wired LAN Driver Updates 2026-08-12 (ice) Przemek Kitszel
2026-08-12 20:18 ` [PATCH net 1/2] ice: move ice_vsi_realloc_stat_arrays() up Przemek Kitszel
2026-08-12 20:18 ` [PATCH net v2 2/2] ice: fix stats array overflow via proper realloc Przemek Kitszel
@ 2026-08-17 15:55 ` Tony Nguyen
2026-08-17 20:51 ` Jakub Kicinski
3 siblings, 0 replies; 6+ messages in thread
From: Tony Nguyen @ 2026-08-17 15:55 UTC (permalink / raw)
To: Przemek Kitszel, netdev, Jakub Kicinski
Cc: intel-wired-lan, Andrew Lunn, David S. Miller, Eric Dumazet,
Paolo Abeni, Michal Schmidt
On 8/12/2026 1:18 PM, Przemek Kitszel wrote:
> fix an issue on ice which increasing VF queue count causes
> out-of-bounds access of the statistics arrays
>
> Przemek Kitszel (2):
> ice: move ice_vsi_realloc_stat_arrays() up
> ice: fix stats array overflow via proper realloc
For the series:
Acked-by: Tony Nguyen <anthony.l.nguyen@intel.com>
> drivers/net/ethernet/intel/ice/ice.h | 2 +
> drivers/net/ethernet/intel/ice/ice_lib.c | 195 ++++++++++-------------
> 2 files changed, 84 insertions(+), 113 deletions(-)
>
> Previous revision of the fix was part of our last bundle [0],
> but here I'm improving only my patches
>
> [0] https://lore.kernel.org/netdev/20260804222205.1580328-1-anthony.l.nguyen@intel.com
>
> changes:
> apply Sashiko feedback for edge cases, see the patch for details
> drop the rest of the patches for now - with the caveat that some
> could still be merged directly from [0] thread
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net 0/2][pull request] Intel Wired LAN Driver Updates 2026-08-12 (ice)
2026-08-12 20:18 [PATCH net 0/2][pull request] Intel Wired LAN Driver Updates 2026-08-12 (ice) Przemek Kitszel
` (2 preceding siblings ...)
2026-08-17 15:55 ` [PATCH net 0/2][pull request] Intel Wired LAN Driver Updates 2026-08-12 (ice) Tony Nguyen
@ 2026-08-17 20:51 ` Jakub Kicinski
3 siblings, 0 replies; 6+ messages in thread
From: Jakub Kicinski @ 2026-08-17 20:51 UTC (permalink / raw)
To: Przemek Kitszel
Cc: netdev, intel-wired-lan, Tony Nguyen, Andrew Lunn,
David S. Miller, Eric Dumazet, Paolo Abeni, Michal Schmidt
On Wed, 12 Aug 2026 22:18:04 +0200 Przemek Kitszel wrote:
> Subject: [PATCH net 0/2][pull request] Intel Wired LAN Driver Updates 2026-08-12 (ice)
BTW you marked as a pull request but there's no PR info.
Make sure to drop the [pull request]
^ permalink raw reply [flat|nested] 6+ messages in thread