* [PATCH] i40e: fix freeing of TX rings on RX allocation failure
2026-09-15 12:26 [PATCH] e1000e: rename init/exit module functions to avoid confusion with e1000 Filip Balluch
@ 2026-09-15 12:26 ` Filip Balluch
2026-09-21 15:30 ` Loktionov, Aleksandr
2026-09-16 6:01 ` [PATCH] e1000e: rename init/exit module functions to avoid confusion with e1000 Loktionov, Aleksandr
2026-09-29 23:13 ` Joe Damato
2 siblings, 1 reply; 5+ messages in thread
From: Filip Balluch @ 2026-09-15 12:26 UTC (permalink / raw)
To: anthony.l.nguyen, przemyslaw.kitszel
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, intel-wired-lan,
netdev, linux-kernel, Filip Balluch
When ethtool -G is used to change ring buffer sizes while the interface is up, i40e_set_ringparam()
allocates temporary TX and RX rings. If the RX ring allocation fails, the error path at the
free_tx label incorrectly calls i40e_free_tx_resources(vsi->tx_rings[i]), freeing the live TX rings
instead of the temporary tx_rings[i].
Since the interface is still up, the next TX completion interrupt causes i40e_clean_tx_irq() to dereference
the freed ring descriptors, resulting in a NULL pointer dereference in IRQ context and a kernel panic.
This can be reproduced on systems with Intel X710 NICs under memory pressure, where
the second port's DMA allocation fails after the first port succeeds.
Fix by freeing the temporary tx_rings[i] in the error path instead of
the live vsi->tx_rings[i].
Signed-off-by: Filip Balluch <fballuch@redhat.com>
---
drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
index 3da9ec49cc74..6d2b076049f7 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
@@ -2249,7 +2249,7 @@ static int i40e_set_ringparam(struct net_device *netdev,
if (tx_rings) {
for (i = 0; i < tx_alloc_queue_pairs; i++) {
if (i40e_active_tx_ring_index(vsi, i))
- i40e_free_tx_resources(vsi->tx_rings[i]);
+ i40e_free_tx_resources(&tx_rings[i]);
}
kfree(tx_rings);
tx_rings = NULL;
--
2.55.0
^ permalink raw reply [flat|nested] 5+ messages in thread* RE: [PATCH] i40e: fix freeing of TX rings on RX allocation failure
2026-09-15 12:26 ` [PATCH] i40e: fix freeing of TX rings on RX allocation failure Filip Balluch
@ 2026-09-21 15:30 ` Loktionov, Aleksandr
0 siblings, 0 replies; 5+ messages in thread
From: Loktionov, Aleksandr @ 2026-09-21 15:30 UTC (permalink / raw)
To: Filip Balluch, Nguyen, Anthony L, Kitszel, Przemyslaw
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, intel-wired-lan,
netdev, linux-kernel
> -----Original Message-----
> From: Filip Balluch <fballuch@redhat.com>
> Sent: Tuesday, September 15, 2026 2:27 PM
> To: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; Kitszel,
> Przemyslaw <przemyslaw.kitszel@intel.com>
> Cc: andrew+netdev@lunn.ch; davem@davemloft.net; edumazet@google.com;
> kuba@kernel.org; pabeni@redhat.com; intel-wired-lan@lists.osuosl.org;
> netdev@vger.kernel.org; linux-kernel@vger.kernel.org; Filip Balluch
> <fballuch@redhat.com>
> Subject: [PATCH] i40e: fix freeing of TX rings on RX allocation
> failure
>
> When ethtool -G is used to change ring buffer sizes while the
> interface is up, i40e_set_ringparam() allocates temporary TX and RX
> rings. If the RX ring allocation fails, the error path at the free_tx
> label incorrectly calls i40e_free_tx_resources(vsi->tx_rings[i]),
> freeing the live TX rings instead of the temporary tx_rings[i].
>
> Since the interface is still up, the next TX completion interrupt
> causes i40e_clean_tx_irq() to dereference the freed ring descriptors,
> resulting in a NULL pointer dereference in IRQ context and a kernel
> panic.
>
> This can be reproduced on systems with Intel X710 NICs under memory
> pressure, where the second port's DMA allocation fails after the first
> port succeeds.
>
> Fix by freeing the temporary tx_rings[i] in the error path instead of
> the live vsi->tx_rings[i].
>
> Signed-off-by: Filip Balluch <fballuch@redhat.com>
> ---
> drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
> b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
> index 3da9ec49cc74..6d2b076049f7 100644
> --- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
> +++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
> @@ -2249,7 +2249,7 @@ static int i40e_set_ringparam(struct net_device
> *netdev,
> if (tx_rings) {
> for (i = 0; i < tx_alloc_queue_pairs; i++) {
> if (i40e_active_tx_ring_index(vsi, i))
> - i40e_free_tx_resources(vsi->tx_rings[i]);
> + i40e_free_tx_resources(&tx_rings[i]);
> }
> kfree(tx_rings);
> tx_rings = NULL;
> --
> 2.55.0
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
^ permalink raw reply [flat|nested] 5+ messages in thread
* RE: [PATCH] e1000e: rename init/exit module functions to avoid confusion with e1000
2026-09-15 12:26 [PATCH] e1000e: rename init/exit module functions to avoid confusion with e1000 Filip Balluch
2026-09-15 12:26 ` [PATCH] i40e: fix freeing of TX rings on RX allocation failure Filip Balluch
@ 2026-09-16 6:01 ` Loktionov, Aleksandr
2026-09-29 23:13 ` Joe Damato
2 siblings, 0 replies; 5+ messages in thread
From: Loktionov, Aleksandr @ 2026-09-16 6:01 UTC (permalink / raw)
To: Filip Balluch, Nguyen, Anthony L, Kitszel, Przemyslaw
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, intel-wired-lan,
netdev, linux-kernel
> -----Original Message-----
> From: Filip Balluch <fballuch@redhat.com>
> Sent: Tuesday, September 15, 2026 2:27 PM
> To: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; Kitszel,
> Przemyslaw <przemyslaw.kitszel@intel.com>
> Cc: andrew+netdev@lunn.ch; davem@davemloft.net; edumazet@google.com;
> kuba@kernel.org; pabeni@redhat.com; intel-wired-lan@lists.osuosl.org;
> netdev@vger.kernel.org; linux-kernel@vger.kernel.org; Filip Balluch
> <fballuch@redhat.com>
> Subject: [PATCH] e1000e: rename init/exit module functions to avoid
> confusion with e1000
>
> The e1000e driver uses e1000_init_module and e1000_exit_module as its
> module init/exit function names, which are identical to those used by
> the older e1000 driver. Rename them to e1000e_init_module and
> e1000e_exit_module to clearly distinguish e1000e from the legacy e1000
> driver.
>
> Signed-off-by: Filip Balluch <fballuch@redhat.com>
> ---
> drivers/net/ethernet/intel/e1000e/netdev.c | 16 ++++++++--------
> 1 file changed, 8 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c
> b/drivers/net/ethernet/intel/e1000e/netdev.c
> index 844f31ab37ad..2a4cf75bce34 100644
> --- a/drivers/net/ethernet/intel/e1000e/netdev.c
> +++ b/drivers/net/ethernet/intel/e1000e/netdev.c
> @@ -8203,31 +8203,31 @@ static struct pci_driver e1000_driver = { };
>
> /**
> - * e1000_init_module - Driver Registration Routine
> + * e1000e_init_module - Driver Registration Routine
> *
> - * e1000_init_module is the first routine called when the driver is
> + * e1000e_init_module is the first routine called when the driver is
> * loaded. All it does is register with the PCI subsystem.
> **/
> -static int __init e1000_init_module(void)
> +static int __init e1000e_init_module(void)
> {
> pr_info("Intel(R) PRO/1000 Network Driver\n");
> pr_info("Copyright(c) 1999 - 2015 Intel Corporation.\n");
>
> return pci_register_driver(&e1000_driver);
> }
> -module_init(e1000_init_module);
> +module_init(e1000e_init_module);
>
> /**
> - * e1000_exit_module - Driver Exit Cleanup Routine
> + * e1000e_exit_module - Driver Exit Cleanup Routine
> *
> - * e1000_exit_module is called just before the driver is removed
> + * e1000e_exit_module is called just before the driver is removed
> * from memory.
> **/
> -static void __exit e1000_exit_module(void)
> +static void __exit e1000e_exit_module(void)
> {
> pci_unregister_driver(&e1000_driver);
> }
> -module_exit(e1000_exit_module);
> +module_exit(e1000e_exit_module);
>
> MODULE_DESCRIPTION("Intel(R) PRO/1000 Network Driver");
> MODULE_LICENSE("GPL v2");
> --
> 2.55.0
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] e1000e: rename init/exit module functions to avoid confusion with e1000
2026-09-15 12:26 [PATCH] e1000e: rename init/exit module functions to avoid confusion with e1000 Filip Balluch
2026-09-15 12:26 ` [PATCH] i40e: fix freeing of TX rings on RX allocation failure Filip Balluch
2026-09-16 6:01 ` [PATCH] e1000e: rename init/exit module functions to avoid confusion with e1000 Loktionov, Aleksandr
@ 2026-09-29 23:13 ` Joe Damato
2 siblings, 0 replies; 5+ messages in thread
From: Joe Damato @ 2026-09-29 23:13 UTC (permalink / raw)
To: Filip Balluch
Cc: anthony.l.nguyen, przemyslaw.kitszel, andrew+netdev, davem,
edumazet, kuba, pabeni, intel-wired-lan, netdev, linux-kernel
On Tue, Sep 15, 2026 at 02:26:38PM +0200, Filip Balluch wrote:
> The e1000e driver uses e1000_init_module and e1000_exit_module as its
> module init/exit function names, which are identical to those used by the
> older e1000 driver. Rename them to e1000e_init_module and
> e1000e_exit_module to clearly distinguish e1000e from the legacy e1000
> driver.
>
> Signed-off-by: Filip Balluch <fballuch@redhat.com>
> ---
> drivers/net/ethernet/intel/e1000e/netdev.c | 16 ++++++++--------
> 1 file changed, 8 insertions(+), 8 deletions(-)
Reviewed-by: Joe Damato <joe@dama.to>
^ permalink raw reply [flat|nested] 5+ messages in thread