Re: [PATCH net] net/mlx5e: Fix queue stats access to queues without stats

[Tariq Toukan <tariqt@nvidia.com>]

On 04/11/2026 19:04, Breno Leitao wrote:
> I am seeing the following mlx5e crash in the Meta fleet:
> 
>    pc : mlx5e_get_queue_stats_rx+0x4c/0xc8
>    Call trace:
>     mlx5e_get_queue_stats_rx+0x4c/0xc8 (P)
>     netdev_stat_queue_sum+0x78/0x480
>     netdev_nl_qstats_get_dump_one+0xf0/0x268
>     netdev_nl_qstats_get_dumpit+0x7c/0x1f8
> 
> When dumping device-wide qstats, the core calls the per-queue callbacks
> for every queue below real_num_{rx,tx}_queues, regardless of whether the
> netdev is up. Some of those queues have no stats behind them:
> 
>   - RX stats live in priv->channel_stats[], which only has entries for
>     channels that have been opened (stats_nch). real_num_rx_queues can
>     be larger, for example after the channel count is raised while the
>     netdev is down, or after opening the channels failed part way.
> 
>   - TX stats are looked up in priv->txq2sq_stats[], which is NULL for
>     SQs that were never activated and for HTB queues while the channels
>     are closed.
> 
> In both cases the callback dereferences a NULL pointer. The dump needs
> no privileges, so any user can trigger it.
> 
> Return early for RX queues at or above stats_nch and for TX queues
> without SQ stats.
> 
> Fixes: 7b66ae536a78 ("net/mlx5e: Add per queue netdev-genl stats")
> Cc: stable@vger.kernel.org
> Signed-off-by: Breno Leitao <leitao@debian.org>
> ---
>   drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 5 ++++-
>   1 file changed, 4 insertions(+), 1 deletion(-)
> 
Thanks for the fix. IMO this is the right minimal change for net.

About the Sashiko finding: right, with HTB configured, the HTB TX stats
drop out of the device totals while the netdev is down, as
mlx5e_get_base_stats() does not count htb_qos_sq_stats[]. But before
this patch the same dump crashed, so it is not a regression, and I'd
fix the accounting separately.

There is more to fix there. While the netdev is down, PTP TX stats are
counted twice, once through the stale txq2sq_stats[] entry and once by
mlx5e_get_base_stats(). And the stats of HTB queues that are no longer
in use are never reported.

For net-next, I suggest reporting per-queue stats only while the 
channels are open, and everything else from mlx5e_get_base_stats(), HTB 
queues included. This follows the netdev_stat_ops documentation ("only 
currently active queues are queried by the per-queue callbacks"). The 
per-queue dump would be empty while the netdev is down, with the device 
totals unchanged across ifdown. The comment above the new NULL check 
would be reworked there as well. We can send it once this patch reaches 
net-next.

Reviewed-by: Tariq Toukan <tariqt@nvidia.com>