RE: [PATCH] i40e: fix freeing of TX rings on RX allocation failure

[Loktionov, Aleksandr]

> -----Original Message-----
> From: Filip Balluch <fballuch@xxxxxxxxxx>
> Sent: Tuesday, September 15, 2026 2:27 PM
> To: Nguyen, Anthony L <anthony.l.nguyen@xxxxxxxxx>; Kitszel,
> Przemyslaw <przemyslaw.kitszel@xxxxxxxxx>
> Cc: andrew+netdev@xxxxxxx; davem@xxxxxxxxxxxxx; edumazet@xxxxxxxxxx;
> kuba@xxxxxxxxxx; pabeni@xxxxxxxxxx; intel-wired-lan@xxxxxxxxxxxxxxxx;
> netdev@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx; Filip Balluch
> <fballuch@xxxxxxxxxx>
> Subject: [PATCH] i40e: fix freeing of TX rings on RX allocation
> failure
> 
> When ethtool -G is used to change ring buffer sizes while the
> interface is up, i40e_set_ringparam() allocates temporary TX and RX
> rings. If the RX ring allocation fails, the error path at the free_tx
> label incorrectly calls i40e_free_tx_resources(vsi->tx_rings[i]),
> freeing the live TX rings instead of the temporary tx_rings[i].
> 
> Since the interface is still up, the next TX completion interrupt
> causes i40e_clean_tx_irq() to dereference the freed ring descriptors,
> resulting in a NULL pointer dereference in IRQ context and a kernel
> panic.
> 
> This can be reproduced on systems with Intel X710 NICs under memory
> pressure, where the second port's DMA allocation fails after the first
> port succeeds.
> 
> Fix by freeing the temporary tx_rings[i] in the error path instead of
> the live vsi->tx_rings[i].
> 
> Signed-off-by: Filip Balluch <fballuch@xxxxxxxxxx>
> ---
>  drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
> b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
> index 3da9ec49cc74..6d2b076049f7 100644
> --- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
> +++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
> @@ -2249,7 +2249,7 @@ static int i40e_set_ringparam(struct net_device
> *netdev,
>  	if (tx_rings) {
>  		for (i = 0; i < tx_alloc_queue_pairs; i++) {
>  			if (i40e_active_tx_ring_index(vsi, i))
> -				i40e_free_tx_resources(vsi->tx_rings[i]);
> +				i40e_free_tx_resources(&tx_rings[i]);
>  		}
>  		kfree(tx_rings);
>  		tx_rings = NULL;
> --
> 2.55.0


Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@xxxxxxxxx>