> -----Original Message-----
> From: Filip Balluch <[email protected]>
> Sent: Tuesday, September 15, 2026 2:27 PM
> To: Nguyen, Anthony L <[email protected]>; Kitszel,
> Przemyslaw <[email protected]>
> Cc: [email protected]; [email protected]; [email protected];
> [email protected]; [email protected]; [email protected];
> [email protected]; [email protected]; Filip Balluch
> <[email protected]>
> Subject: [PATCH] i40e: fix freeing of TX rings on RX allocation
> failure
>
> When ethtool -G is used to change ring buffer sizes while the
> interface is up, i40e_set_ringparam() allocates temporary TX and RX
> rings. If the RX ring allocation fails, the error path at the free_tx
> label incorrectly calls i40e_free_tx_resources(vsi->tx_rings[i]),
> freeing the live TX rings instead of the temporary tx_rings[i].
>
> Since the interface is still up, the next TX completion interrupt
> causes i40e_clean_tx_irq() to dereference the freed ring descriptors,
> resulting in a NULL pointer dereference in IRQ context and a kernel
> panic.
>
> This can be reproduced on systems with Intel X710 NICs under memory
> pressure, where the second port's DMA allocation fails after the first
> port succeeds.
>
> Fix by freeing the temporary tx_rings[i] in the error path instead of
> the live vsi->tx_rings[i].
>
> Signed-off-by: Filip Balluch <[email protected]>
> ---
> drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
> b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
> index 3da9ec49cc74..6d2b076049f7 100644
> --- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
> +++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
> @@ -2249,7 +2249,7 @@ static int i40e_set_ringparam(struct net_device
> *netdev,
> if (tx_rings) {
> for (i = 0; i < tx_alloc_queue_pairs; i++) {
> if (i40e_active_tx_ring_index(vsi, i))
> - i40e_free_tx_resources(vsi->tx_rings[i]);
> + i40e_free_tx_resources(&tx_rings[i]);
> }
> kfree(tx_rings);
> tx_rings = NULL;
> --
> 2.55.0
Reviewed-by: Aleksandr Loktionov <[email protected]>
