From: Kiran Patil During a concurrent reset, q_vectors are freed and re-allocated while the watchdog task may still be iterating rings in iavf_detect_recover_hung(). Dereferencing a NULL q_vector inside iavf_force_wb() results in a crash. Guard against this by skipping rings whose q_vector is NULL. Also move the tx_ring declaration into the loop body and drop the redundant outer NULL initialisation, which the compiler can never observe since an array-element address is always non-NULL. Fixes: 9c6c12595b73 ("i40e: Detection and recovery of TX queue hung logic moved to service_task from tx_timeout") Signed-off-by: Kiran Patil Signed-off-by: Aleksandr Loktionov --- drivers/net/ethernet/intel/iavf/iavf_txrx.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/intel/iavf/iavf_txrx.c b/drivers/net/ethernet/intel/iavf/iavf_txrx.c index 363c42b..e7e7fc9 100644 --- a/drivers/net/ethernet/intel/iavf/iavf_txrx.c +++ b/drivers/net/ethernet/intel/iavf/iavf_txrx.c @@ -176,7 +176,6 @@ static void iavf_force_wb(struct iavf_vsi *vsi, struct iavf_q_vector *q_vector) **/ void iavf_detect_recover_hung(struct iavf_vsi *vsi) { - struct iavf_ring *tx_ring = NULL; struct net_device *netdev; unsigned int i; int packets; @@ -195,8 +194,11 @@ void iavf_detect_recover_hung(struct iavf_vsi *vsi) return; for (i = 0; i < vsi->back->num_active_queues; i++) { - tx_ring = &vsi->back->tx_rings[i]; - if (tx_ring && tx_ring->desc) { + struct iavf_ring *tx_ring = &vsi->back->tx_rings[i]; + + if (!tx_ring || !tx_ring->q_vector) + continue; + if (tx_ring->desc) { /* If packet counter has not changed the queue is * likely stalled, so force an interrupt for this * queue. -- 2.52.0 From: Piotr Gardocki When request_irq() fails the interrupt vector was not registered for the driver. Calling free_irq() on a vector that was never successfully requested triggers a kernel warning. Drop the erroneous free_irq() call from the error path. Fixes: 5eae00c57f5e ("i40evf: main driver core") Signed-off-by: Piotr Gardocki Signed-off-by: Aleksandr Loktionov --- drivers/net/ethernet/intel/iavf/iavf_main.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c index dad001a..ab5f5adc 100644 --- a/drivers/net/ethernet/intel/iavf/iavf_main.c +++ b/drivers/net/ethernet/intel/iavf/iavf_main.c @@ -587,7 +587,6 @@ static int iavf_request_misc_irq(struct iavf_adapter *adapter) dev_err(&adapter->pdev->dev, "request_irq for %s failed: %d\n", adapter->misc_vector_name, err); - free_irq(adapter->msix_entries[0].vector, netdev); } return err; } -- 2.52.0 From: Sylwester Dziedziuch Changing ring parameters via ethtool triggers a VF reset and queue reconfiguration. If ethtool is called again before the first reset completes, the second reset races with uninitialised queue state and can corrupt the VSI resource tree on the PF side. Return -EAGAIN from iavf_set_ringparam() when the adapter is already resetting or its queues are disabled. Fixes: fbb7ddfef253 ("i40evf: core ethtool functionality") Signed-off-by: Sylwester Dziedziuch Signed-off-by: Aleksandr Loktionov --- drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c index 1cd1f3f..3909131 100644 --- a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c +++ b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c @@ -495,6 +495,11 @@ static int iavf_set_ringparam(struct net_device *netdev, if ((ring->rx_mini_pending) || (ring->rx_jumbo_pending)) return -EINVAL; + if (adapter->state == __IAVF_RESETTING || + (adapter->state == __IAVF_RUNNING && + adapter->flags & IAVF_FLAG_QUEUES_DISABLED)) + return -EAGAIN; + if (ring->tx_pending > IAVF_MAX_TXD || ring->tx_pending < IAVF_MIN_TXD || ring->rx_pending > IAVF_MAX_RXD || -- 2.52.0 From: Avinash Dayanand The condition `tc < adapter->num_tc` admits any tc value equal to or greater than num_tc, bypassing the destination-port validation and allowing traffic to be steered to a non-existent traffic class. Change the comparison to `tc > adapter->num_tc` to correctly reject out-of-range TC values. Fixes: 0075fa0fadd0 ("i40evf: Add support to apply cloud filters") Signed-off-by: Avinash Dayanand Signed-off-by: Aleksandr Loktionov --- drivers/net/ethernet/intel/iavf/iavf_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c index ab5f5adc..5e4035b 100644 --- a/drivers/net/ethernet/intel/iavf/iavf_main.c +++ b/drivers/net/ethernet/intel/iavf/iavf_main.c @@ -4062,7 +4062,7 @@ static int iavf_handle_tclass(struct iavf_adapter *adapter, u32 tc, { if (tc == 0) return 0; - if (tc < adapter->num_tc) { + if (tc > adapter->num_tc) { if (!filter->f.data.tcp_spec.dst_port) { dev_err(&adapter->pdev->dev, "Specify destination port to redirect to traffic class other than TC0\n"); -- 2.52.0 From: Kiran Patil When an egress qdisc is destroyed, the driver proactively deletes all associated cloud filters to prevent stale hardware state, decrementing num_cloud_filters to zero in the process. The kernel netdev layer is unaware of this implicit cleanup and may still try to delete the same filters individually. If the filter is not found in the driver's list and num_cloud_filters is already zero, return 0 instead of -EINVAL to avoid confusing upper layers that believe the filter is still offloaded in hardware. Fixes: 0075fa0fadd0 ("i40evf: Add support to apply cloud filters") Signed-off-by: Kiran Patil Signed-off-by: Aleksandr Loktionov --- drivers/net/ethernet/intel/iavf/iavf_main.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c index 5e4035b..05aaae9 100644 --- a/drivers/net/ethernet/intel/iavf/iavf_main.c +++ b/drivers/net/ethernet/intel/iavf/iavf_main.c @@ -4175,7 +4175,16 @@ static int iavf_delete_clsflower(struct iavf_adapter *adapter, if (filter) { filter->del = true; adapter->aq_required |= IAVF_FLAG_AQ_DEL_CLOUD_FILTER; - } else { + } else if (adapter->num_cloud_filters) { + /* When the egress qdisc is detached the driver implicitly + * deletes all associated cloud filters to prevent stale + * hardware entries, reducing num_cloud_filters to zero. + * The netdev layer is unaware of this implicit cleanup and + * may still request deletion of individual filters. Only + * return -EINVAL when a filter lookup fails and + * num_cloud_filters is non-zero, indicating a genuine + * lookup failure rather than a post-teardown stale delete. + */ err = -EINVAL; } spin_unlock_bh(&adapter->cloud_filter_list_lock); -- 2.52.0