RE: [PATCH] i40e: fix freeing of TX rings on RX allocation failure

-----Original Message-----
From: Filip Balluch <redacted>
Sent: Tuesday, September 15, 2026 2:27 PM
To: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; Kitszel,
Przemyslaw [off-list ref]
Cc: andrew+netdev@lunn.ch; davem@davemloft.net; edumazet@google.com;
kuba@kernel.org; pabeni@redhat.com; intel-wired-lan@lists.osuosl.org;
netdev@vger.kernel.org; linux-kernel@vger.kernel.org; Filip Balluch
[off-list ref]
Subject: [PATCH] i40e: fix freeing of TX rings on RX allocation
failure

When ethtool -G is used to change ring buffer sizes while the
interface is up, i40e_set_ringparam() allocates temporary TX and RX
rings. If the RX ring allocation fails, the error path at the free_tx
label incorrectly calls i40e_free_tx_resources(vsi->tx_rings[i]),
freeing the live TX rings instead of the temporary tx_rings[i].

Since the interface is still up, the next TX completion interrupt
causes i40e_clean_tx_irq() to dereference the freed ring descriptors,
resulting in a NULL pointer dereference in IRQ context and a kernel
panic.

This can be reproduced on systems with Intel X710 NICs under memory
pressure, where the second port's DMA allocation fails after the first
port succeeds.

Fix by freeing the temporary tx_rings[i] in the error path instead of
the live vsi->tx_rings[i].

Signed-off-by: Filip Balluch <redacted>
---
 drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c

b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
index 3da9ec49cc74..6d2b076049f7 100644

--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c

@@ -2249,7 +2249,7 @@ static int i40e_set_ringparam(struct net_device

*netdev,
 	if (tx_rings) {
 		for (i = 0; i < tx_alloc_queue_pairs; i++) {
 			if (i40e_active_tx_ring_index(vsi, i))
-				i40e_free_tx_resources(vsi->tx_rings[i]);
+				i40e_free_tx_resources(&tx_rings[i]);
 		}
 		kfree(tx_rings);
 		tx_rings = NULL;
--
2.55.0