From: Filip Balluch <redacted>
When ethtool -G is used to change ring buffer sizes while the interface is
up, i40e_set_ringparam() allocates temporary TX and RX rings. If the RX
ring allocation fails, the error path at the free_tx label incorrectly
calls i40e_free_tx_resources(vsi->tx_rings[i]), freeing the live TX rings
instead of the temporary tx_rings[i].
Since the interface is still up, the next TX completion interrupt causes
i40e_clean_tx_irq() to dereference the freed ring descriptors, resulting in
a NULL pointer dereference in IRQ context and a kernel panic.
This can be reproduced on systems with Intel X710 NICs under memory
pressure, where the second port's DMA allocation fails after the first port
succeeds.
Fix by freeing the temporary tx_rings[i] in the error path instead of
the live vsi->tx_rings[i].
Fixes: 74608d17fe29 ("i40e: add support for XDP_TX action")
Signed-off-by: Filip Balluch <redacted>
Reviewed-by: Aleksandr Loktionov <redacted>
Tested-by: Alexander Nowlin <redacted>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
---
drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
index 6a992df06fa1..ef756487d668 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
@@ -2249,7 +2249,7 @@ static int i40e_set_ringparam(struct net_device *netdev,
if (tx_rings) {
for (i = 0; i < tx_alloc_queue_pairs; i++) {
if (i40e_active_tx_ring_index(vsi, i))
- i40e_free_tx_resources(vsi->tx_rings[i]);
+ i40e_free_tx_resources(&tx_rings[i]);
}
kfree(tx_rings);
tx_rings = NULL;--
2.47.1