On Fri, Aug 21, 2026 at 03:01:55PM +0200, Aleksandr Loktionov wrote: > i40e_set_ringparam() has two independent ways to crash a live queue > while resizing descriptors. Both need a failure injected into the > middle of the resize to hit, but both are 100% reliable once you know > where. > > Patch 1 is the reported bug: the free_tx: label frees vsi->tx_rings[i] > (the live, NAPI-active ring) instead of &tx_rings[i] (the staged copy), > on Rx allocation failure. desc/tx_bi go to NULL under a running NAPI, > next poll dereferences them. Reproduced by forcing an Rx alloc failure > right after a Tx descriptor count change; panic address matched the > original report exactly (CR2 == old_count * sizeof(desc)). > > Patch 2 was found reviewing patch 1. The staged tx_rings[] copies are > shallow copies of the live rings, so they carry over the same > ring->netdev/queue_index. Freeing one of these copies before > i40e_down() has run - either from this same free_tx: label or from the > i40e_setup_tx_descriptors() failure unwind loop above it - resets BQL > state for the live queue it was copied from. dql_completed() then > BUG_ONs the next time the live ring reports a completion that was > queued before the reset. This one predates patch 1's bug by four > years (Fixes: 9f65e15b4f98, 2013) and doesn't need patch 1 applied to > be reachable via the setup_tx_descriptors() path. > > Reproduced by forcing i40e_setup_tx_descriptors() to fail on a later > queue while flooding real Tx traffic on the earlier ones: > > kernel BUG at lib/dynamic_queue_limits.c:99! > RIP: dql_completed+0x285/0x2a0 > Call Trace: > <IRQ> > i40e_napi_poll+0x74b/0x1700 [i40e] > __napi_poll+0x10a/0x200 > net_rx_action+0x2f7/0x380 > handle_softirqs+0xcc/0x270 > > Confirmed clean with the fix applied, same traffic, repeated > resize cycles. > > Patch 2 touches both error paths above, but only the free_tx: hunk > needs patch 1 applied first to match its diff context - the > setup_tx_descriptors() unwind hunk applies, and matters, on its own. > > Cc: Simon Horman <[email protected]> > > Aleksandr Loktionov (2): > i40e: fix set_ringparam error path freeing live Tx rings > i40e: avoid resetting BQL state when freeing temporary Tx rings in > set_ringparam
Thanks for the update. For the series: Reviewed-by: Simon Horman <[email protected]>
