On 2/2/2026 8:17 AM, Kohei Enju wrote:
When changing RX queue length via 'ethtool -G $DEV rx $NUM', a WARNING
indicates the driver missed unregistering xdp_rxq_info [1], and then
NULL pointer dereference panics the kernel. [2]
The following sequence in ice_set_ringparam() triggers this bug.
1. Allocate new rx_rings
2. rx_rings[i] = *vsi->rx_rings[i];
3. ice_down() unregisters vsi->rx_rings[i]->xdp_rxq
4. ice_up() registers rx_ring[i]->xdp_rxq
a. __xdp_rxq_info_reg() sees the copied state REG_STATE_REGISTERED
and calls xdp_rxq_info_unreg() to fix it [1]
b. xdp_unreg_mem_model() looks up the stale mem.id in rhashtable,
which was already removed in step 3, causing NULL dereference [2]
The root cause is that struct copying includes xdp_rxq_info which
contains registration state that should not be duplicated.
Fix by clearing xdp_rxq_info after copying the ring so it starts with
REG_STATE_NEW instead of the stale REG_STATE_REGISTERED.
[1]
Missing unregister, handled but fix driver
WARNING: net/core/xdp.c:182 at __xdp_rxq_info_reg+0x89/0x150, CPU#4:
ethtool/1105
[...]
RIP: 0010:__xdp_rxq_info_reg+0x89/0x150
[...]
Call Trace:
<TASK>
ice_queue_mem_alloc+0x159/0x240
ice_vsi_cfg_rxq+0xc3/0x160
ice_vsi_cfg_rxqs+0x4f/0x70
ice_up+0xd/0x20
ice_set_ringparam+0x34f/0x4e0
[2]
BUG: kernel NULL pointer dereference, address: 0000000000000008
[...]
RIP: 0010:xdp_unreg_mem_model+0x113/0x340
[...]
Call Trace:
<TASK>
__xdp_rxq_info_reg+0xfd/0x150
ice_queue_mem_alloc+0x159/0x240
ice_vsi_cfg_rxq+0xc3/0x160
ice_vsi_cfg_rxqs+0x4f/0x70
ice_up+0xd/0x20
ice_set_ringparam+0x34f/0x4e0
Fixes: 111a8e2be488 ("ice: implement Rx queue management ops")
Signed-off-by: Kohei Enju <[email protected]>
---
I see the Fixes: commit exists in only tnguy/next-queue.git, so I'm
sending this patch to iwl-next, not iwl-net.
Also IIUC dev-queue in tnguy/next-queue.git is rebased continuously, so
the commit hash will be stale soon, and I don't know how to handle this.
Yea. Including the full subject line should be sufficient for Tony to
find this.
I'd appreciate it if iwl-folks know the way to handle it. Thanks!
Ideally we can squash this in with the implementation patches and
include your Co-developed-by and Signed-off-by tags if you would agree
to that?
