Re: [PATCH net] ice: fix stats array overflow when VF requests more queues

[Przemek Kitszel]

On 4/27/26 17:18, Michal Schmidt wrote:
> When a VF increases its queue count via VIRTCHNL_OP_REQUEST_QUEUES,
> ice_vc_request_qs_msg() sets vf->num_req_qs and triggers a VF reset.
> The reset calls ice_vf_reconfig_vsi(), which does ice_vsi_decfg()
> followed by ice_vsi_cfg(). ice_vsi_decfg() does not free the per-ring
> stats arrays. Inside ice_vsi_cfg_def(), ice_vsi_set_num_qs() updates
> alloc_txq/alloc_rxq to the new larger value, but
> ice_vsi_alloc_stat_arrays() returns early because the stats already
> exist. ice_vsi_alloc_ring_stats() then iterates using the new larger
> alloc_txq and writes beyond the bounds of the old, smaller
> tx_ring_stats/rx_ring_stats pointer arrays, corrupting adjacent SLUB
> metadata.
>
> KASAN detects the bug:

[...]

> ice_vsi_rebuild() handles this correctly by calling
> ice_vsi_realloc_stat_arrays() before reconfiguration, but
> ice_vf_reconfig_vsi() was missing this call.
>
> Fix by calling ice_vsi_realloc_stat_arrays() in ice_vf_reconfig_vsi()
> before ice_vsi_decfg(), mirroring the ice_vsi_rebuild() pattern. Set
> vsi->req_txq/req_rxq from vf->num_req_qs so the realloc function knows
> the target array size.
>
> See the linked RHEL Jira item for a reproducer.
>
> Fixes: 2a2cb4c6c181 ("ice: replace ice_vf_recreate_vsi() with ice_vf_reconfig_vsi()")
> Closes: https://redhat.atlassian.net/browse/RHEL-164321
> Signed-off-by: Michal Schmidt <mschmidt@xxxxxxxxxx>

I have an unpublished fix for the same issue,
but your patch is smaller, and thus more suitable for net-

Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@xxxxxxxxx>

thank you

> Assisted-by: Claude:claude-opus-4-6 semcode
> ---
>   drivers/net/ethernet/intel/ice/ice_lib.c    | 2 +-
>   drivers/net/ethernet/intel/ice/ice_lib.h    | 1 +
>   drivers/net/ethernet/intel/ice/ice_vf_lib.c | 7 +++++++
>   3 files changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c
> index 837b71b7b2b7..fc78176a2a8d 100644
> --- a/drivers/net/ethernet/intel/ice/ice_lib.c
> +++ b/drivers/net/ethernet/intel/ice/ice_lib.c
> @@ -3015,7 +3015,7 @@ ice_vsi_rebuild_set_coalesce(struct ice_vsi *vsi,
>    * ice_vsi_realloc_stat_arrays - Frees unused stat structures or alloc new ones
>    * @vsi: VSI pointer
>    */
> -static int
> +int
>   ice_vsi_realloc_stat_arrays(struct ice_vsi *vsi)
>   {
>   	u16 req_txq = vsi->req_txq ? vsi->req_txq : vsi->alloc_txq;
> diff --git a/drivers/net/ethernet/intel/ice/ice_lib.h b/drivers/net/ethernet/intel/ice/ice_lib.h
> index 49454d98dcfe..6f7da84384e5 100644
> --- a/drivers/net/ethernet/intel/ice/ice_lib.h
> +++ b/drivers/net/ethernet/intel/ice/ice_lib.h
> @@ -66,6 +66,7 @@ int ice_ena_vsi(struct ice_vsi *vsi, bool locked);
>   void ice_vsi_decfg(struct ice_vsi *vsi);
>   void ice_dis_vsi(struct ice_vsi *vsi, bool locked);
>   
> +int ice_vsi_realloc_stat_arrays(struct ice_vsi *vsi);
>   int ice_vsi_rebuild(struct ice_vsi *vsi, u32 vsi_flags);
>   int ice_vsi_cfg(struct ice_vsi *vsi);
>   struct ice_vsi *ice_vsi_alloc(struct ice_pf *pf);
> diff --git a/drivers/net/ethernet/intel/ice/ice_vf_lib.c b/drivers/net/ethernet/intel/ice/ice_vf_lib.c
> index 772f6b07340d..9edb2c14f553 100644
> --- a/drivers/net/ethernet/intel/ice/ice_vf_lib.c
> +++ b/drivers/net/ethernet/intel/ice/ice_vf_lib.c
> @@ -268,6 +268,13 @@ static int ice_vf_reconfig_vsi(struct ice_vf *vf)
>   
>   	vsi->flags = ICE_VSI_FLAG_NO_INIT;
>   
> +	vsi->req_txq = vf->num_req_qs;
> +	vsi->req_rxq = vf->num_req_qs;
> +
> +	err = ice_vsi_realloc_stat_arrays(vsi);
> +	if (err)
> +		return err;
> +
>   	ice_vsi_decfg(vsi);
>   	ice_fltr_remove_all(vsi);
>