On 11.06.2026 18:12, Dawei Feng wrote:
> ice_lbtest_prepare_rings() frees Rx rings only when
> ice_vsi_start_all_rx_rings() fails. If ice_vsi_setup_rx_rings() fails
> after allocating some descriptors, or if ice_vsi_cfg_lan() fails after
> the Rx rings were prepared, the function reaches the Tx cleanup path
> without releasing the initialized Rx resources.
>
> Fix this by adding separate unwind paths for Rx setup failure and LAN
> configuration failure. The Rx setup failure path releases the partially
> prepared Rx rings before freeing Tx rings, while later failures first
> undo the LAN Tx configuration and then release the Rx rings in reverse
> setup order.
>
> The bug was first flagged by an experimental analysis tool we are
> developing for kernel memory-management bugs while analyzing
> v6.13-rc1. The tool is still under development and is not yet publicly
> available. Manual inspection confirms that the bug is still
> present in v7.1-rc5.
>
> An x86_64 allyesconfig build showed no new warnings. As we do not have an
> Intel E800 Series adapter available to run the ethtool offline loopback
> selftest, no runtime testing was able to be performed.
>
> Fixes: 0e674aeb0b77 ("ice: Add handler for ethtool selftest")
> Cc: [email protected]
> Signed-off-by: Zilin Guan <[email protected]>
> Signed-off-by: Dawei Feng <[email protected]>
LGTM
Reviewed-by: Marcin Szycik <[email protected]>
> ---
> Changes in v2:
> - Fix cleanup order
>
> drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c
> b/drivers/net/ethernet/intel/ice/ice_ethtool.c
> index f28416a707d7..10a4abc66974 100644
> --- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
> +++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
> @@ -1069,18 +1069,18 @@ static int ice_lbtest_prepare_rings(struct ice_vsi
> *vsi)
>
> status = ice_vsi_cfg_lan(vsi);
> if (status)
> - goto err_setup_rx_ring;
> + goto err_cfg_lan;
>
> status = ice_vsi_start_all_rx_rings(vsi);
> if (status)
> - goto err_start_rx_ring;
> + goto err_cfg_lan;
>
> return 0;
>
> -err_start_rx_ring:
> - ice_vsi_free_rx_rings(vsi);
> -err_setup_rx_ring:
> +err_cfg_lan:
> ice_vsi_stop_lan_tx_rings(vsi, ICE_NO_RESET, 0);
> +err_setup_rx_ring:
> + ice_vsi_free_rx_rings(vsi);
> err_setup_tx_ring:
> ice_vsi_free_tx_rings(vsi);
>
