When changing RX queue length via 'ethtool -G $DEV rx $NUM', a WARNING indicates the driver missed unregistering xdp_rxq_info [1], and then NULL pointer dereference panics the kernel. [2] The following sequence in ice_set_ringparam() triggers this bug. 1. Allocate new rx_rings 2. rx_rings[i] = *vsi->rx_rings[i]; 3. ice_down() unregisters vsi->rx_rings[i]->xdp_rxq 4. ice_up() registers rx_ring[i]->xdp_rxq a. __xdp_rxq_info_reg() sees the copied state REG_STATE_REGISTERED and calls xdp_rxq_info_unreg() to fix it [1] b. xdp_unreg_mem_model() looks up the stale mem.id in rhashtable, which was already removed in step 3, causing NULL dereference [2] The root cause is that struct copying includes xdp_rxq_info which contains registration state that should not be duplicated. Fix by clearing xdp_rxq_info after copying the ring so it starts with REG_STATE_NEW instead of the stale REG_STATE_REGISTERED. [1] Missing unregister, handled but fix driver WARNING: net/core/xdp.c:182 at __xdp_rxq_info_reg+0x89/0x150, CPU#4: ethtool/1105 [...] RIP: 0010:__xdp_rxq_info_reg+0x89/0x150 [...] Call Trace: ice_queue_mem_alloc+0x159/0x240 ice_vsi_cfg_rxq+0xc3/0x160 ice_vsi_cfg_rxqs+0x4f/0x70 ice_up+0xd/0x20 ice_set_ringparam+0x34f/0x4e0 [2] BUG: kernel NULL pointer dereference, address: 0000000000000008 [...] RIP: 0010:xdp_unreg_mem_model+0x113/0x340 [...] Call Trace: __xdp_rxq_info_reg+0xfd/0x150 ice_queue_mem_alloc+0x159/0x240 ice_vsi_cfg_rxq+0xc3/0x160 ice_vsi_cfg_rxqs+0x4f/0x70 ice_up+0xd/0x20 ice_set_ringparam+0x34f/0x4e0 Fixes: 111a8e2be488 ("ice: implement Rx queue management ops") Signed-off-by: Kohei Enju --- I see the Fixes: commit exists in only tnguy/next-queue.git, so I'm sending this patch to iwl-next, not iwl-net. Also IIUC dev-queue in tnguy/next-queue.git is rebased continuously, so the commit hash will be stale soon, and I don't know how to handle this. I'd appreciate it if iwl-folks know the way to handle it. Thanks! --- drivers/net/ethernet/intel/ice/ice_ethtool.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c index ddd252fb1124..e4c286a22ff5 100644 --- a/drivers/net/ethernet/intel/ice/ice_ethtool.c +++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c @@ -3338,6 +3338,7 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring, rx_rings[i].cached_phctime = pf->ptp.cached_phc_time; rx_rings[i].desc = NULL; rx_rings[i].xdp_buf = NULL; + memset(&rx_rings[i].xdp_rxq, 0, sizeof(rx_rings[i].xdp_rxq)); /* this is to allow wr32 to have something to write to * during early allocation of Rx buffers -- 2.51.0