Re: [PATCH v2] ibmvnic: fix OOB array access in ibmvnic_xmit on queue count reduction

[Jakub Kicinski]

On Wed,  1 Apr 2026 00:08:45 -0500 Tyllis Xu wrote:
> When the number of TX queues is reduced (e.g., via ethtool -L), the
> Qdisc layer retains previously enqueued skbs with queue mappings from
> before the reduction. After the reset completes and tx_queues_active is
> set to true, netif_tx_start_all_queues() drains these stale skbs through
> ibmvnic_xmit(). The queue index from skb_get_queue_mapping() may exceed
> the newly allocated array bounds, causing out-of-bounds reads on
> tx_scrq[] and tx_pool[]/tso_pool[].

This should not happen if the interface configures itself correctly, see
https://lore.kernel.org/all/20260106182244.7188a8f6@xxxxxxxxxx/

Please share are a repro if you have one.