-----Original Message-----
From: Kitszel, Przemyslaw <przemyslaw.kitszel@intel.com>
Sent: Tuesday, July 7, 2026 12:44 AM
To: intel-wired-lan@lists.osuosl.org; Schmidt, Michal
[off-list ref]; Jakub Kicinski [off-list ref]
Cc: netdev@vger.kernel.org; Nguyen, Anthony L
[off-list ref]; Loktionov, Aleksandr
[off-list ref]; Andrew Lunn [off-list ref];
David S. Miller [off-list ref]; Eric Dumazet
[off-list ref]; Paolo Abeni [off-list ref]; Jagielski,
Jedrzej [off-list ref]; Kwapulinski, Piotr
[off-list ref]; Kitszel, Przemyslaw
[off-list ref]; Marcin Szycik
[off-list ref]
Subject: [PATCH iwl-net v2 2/2] ice: fix stats array overflow via
proper realloc

Integrate ice_vsi_alloc_stat_arrays() with realloc variant.

Instead of keeping two functions for stat arrays allocation, change
the
ice_vsi_realloc_stat_arrays() to handle initial condition (no vsi_stat
entry) and replace ice_vsi_alloc_stat_arrays() by the more generic
ice_vsi_realloc_stat_arrays().

Note that VSIs of ICE_VSI_CHNL type are ignored in realloc variant as
they were in the replaced ice_vsi_alloc_stat_arrays().

This is a fix for stats array overflow that occurs when VF is given
more queues (an operation that will be more frequent, and by bigger
increase, when we will merge my "XLVF" series).

Splat for increasing number of queues thanks to Michal Schmidt:
KASAN detects the bug:
 ==================================================================
 BUG: KASAN: slab-out-of-bounds in
ice_vsi_alloc_ring_stats+0x385/0x4a0 [ice]  Read of size 8 at addr
ffff88810affea60 by task kworker/u131:7/221

 CPU: 24 UID: 0 PID: 221 Comm: kworker/u131:7 Not tainted 7.1.0-rc1+
#1 PREEMPT(lazy)  ...
 Workqueue: ice ice_service_task [ice]
 Call Trace:
  <TASK>
  ...
  kasan_report+0xd7/0x120
  ice_vsi_alloc_ring_stats+0x385/0x4a0 [ice]
  ice_vsi_cfg_def+0x12e2/0x2060 [ice]
  ice_vsi_cfg+0xb5/0x3c0 [ice]
  ice_reset_vf+0x858/0xf80 [ice]
  ice_vc_request_qs_msg+0x1da/0x290 [ice]
  ice_vc_process_vf_msg+0xb15/0x1430 [ice]
  __ice_clean_ctrlq+0x70d/0x9d0 [ice]
  ice_service_task+0x840/0xf20 [ice]
  process_one_work+0x690/0xff0
  worker_thread+0x4d9/0xd20
  kthread+0x322/0x410
  ret_from_fork+0x332/0x660
  ret_from_fork_asm+0x1a/0x30
  </TASK>

 Allocated by task 2439:
  kasan_save_stack+0x1c/0x40
  kasan_save_track+0x10/0x30
  __kasan_kmalloc+0x96/0xb0
  __kmalloc_noprof+0x1d8/0x580
  ice_vsi_cfg_def+0x115c/0x2060 [ice]
  ice_vsi_cfg+0xb5/0x3c0 [ice]
  ice_vsi_setup+0x180/0x320 [ice]
  ice_start_vfs+0x1f3/0x590 [ice]
  ice_ena_vfs+0x66d/0x798 [ice]
  ice_sriov_configure.cold+0xe4/0x121 [ice]
  sriov_numvfs_store+0x279/0x480
  kernfs_fop_write_iter+0x331/0x4f0
  vfs_write+0x4c4/0xe40
  ksys_write+0x10c/0x240
  do_syscall_64+0xd9/0x650
  entry_SYSCALL_64_after_hwframe+0x76/0x7e

 The buggy address belongs to the object at ffff88810affea40
                which belongs to the cache kmalloc-32 of size 32  The
buggy address is located 0 bytes to the right of
                allocated 32-byte region [ffff88810affea40,
ffff88810affea60)

Fixes: 2a2cb4c6c181 ("ice: replace ice_vf_recreate_vsi() with
ice_vf_reconfig_vsi()")
Closes: https://redhat.atlassian.net/browse/RHEL-164321
Reviewed-by: Marcin Szycik <redacted>
Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
---
This is an alternative to the fix [1] by Michal Schmidt, which were
blocked due to AI feedback. My fix was already developed before
Michal's, just not public back then. We have agreed to go on with my
version.

[1] https://lore.kernel.org/netdev/20260520183501.3360810-3-
anthony.l.nguyen@intel.com

v1:
https://lore.kernel.org/intel-wired-lan/20260701104141.9740-2-
przemyslaw.kitszel@intel.com

v2: Sashiko:
 * defer pf->vsi_stats[vsi->idx] to be done only after successful Tx
and Rx stats arrays
      allocation - this avoids "half initialized" state processing in
ice_vsi_free_stats().
    The above was reported by both opus-4.6 and gemini-3.1-pro. All
other errors reported by
    just gemini were a mix between false-positives and too-
cornercase'y. Gemini report for v1:
    https://sashiko.dev/#/patchset/20260701104141.9740-1-
przemyslaw.kitszel%40intel.com
 * store also array lengths in separate variable for better tracking
and proper freeing.
---
 drivers/net/ethernet/intel/ice/ice.h     |  2 +
 drivers/net/ethernet/intel/ice/ice_lib.c | 80 ++++++++---------------
-
 2 files changed, 29 insertions(+), 53 deletions(-)

diff --git a/drivers/net/ethernet/intel/ice/ice.h

b/drivers/net/ethernet/intel/ice/ice.h
index f72bb1aa4067..b63b59f2d203 100644

--- a/drivers/net/ethernet/intel/ice/ice.h
+++ b/drivers/net/ethernet/intel/ice/ice.h

@@ -328,6 +328,8 @@ enum ice_vsi_state {  struct ice_vsi_stats {
 	struct ice_ring_stats **tx_ring_stats;  /* Tx ring stats array

*/
 	struct ice_ring_stats **rx_ring_stats;  /* Rx ring stats array
*/