RE: [Intel-wired-lan] [PATCH net v2] ixgbe: fix incomplete ACI command buffer backup on retry

[Nowlin, Alexander]

> -----Original Message-----
> From: Linkui Xiao <xiaolinkui@xxxxxxx> 
> Sent: Thursday, September 17, 2026 4:55 AM
> To: Nguyen, Anthony L <anthony.l.nguyen@xxxxxxxxx>; Kitszel, Przemyslaw <przemyslaw.kitszel@xxxxxxxxx>; andrew+netdev@xxxxxxx; davem@xxxxxxxxxxxxx; edumazet@xxxxxxxxxx; kuba@xxxxxxxxxx; pabeni@xxxxxxxxxx
> Cc: intel-wired-lan@xxxxxxxxxxxxxxxx; netdev@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx; Linkui Xiao <xiaolinkui@xxxxxxxxxx>
> Subject: [Intel-wired-lan] [PATCH net v2] ixgbe: fix incomplete ACI command buffer backup on retry
> 
> From: Linkui Xiao <xiaolinkui@xxxxxxxxxx>
> 
> ixgbe_aci_send_cmd() saves only the first byte of the caller's buffer before an EBUSY retry, using kmalloc() plus a single-byte store. When retries are exhausted, the caller's output buffer is filled with uninitialized > slab bytes, because only the first byte was saved before the retry. The firmware itself does not see this data, since the retryable opcodes do not set LIBIE_AQ_FLAG_RD, but the caller still receives garbage in its output buffer.
> 
> Replace the kmalloc() plus single-byte store with kmemdup() so the whole indirect command buffer is saved before an EBUSY retry, skip the backup when buf_size is 0, and key the restore off buf_cpy instead of > buf, exactly like ice_sq_send_cmd_retry() already does.
> 
> Fixes: c9e563cae19e ("ixgbe: add support for devlink reload")
> Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@xxxxxxxxx>
> Signed-off-by: Linkui Xiao <xiaolinkui@xxxxxxxxxx>
> ---
> V1: https://lore.kernel.org/all/20260912013403.2818191-1-xiaolinkui@xxxxxxx/
> 
> V2:
> - reword the impact description: the firmware does not see the
>   uninitialized slab bytes, only the caller's output buffer does, since
>   the retryable opcodes do not set LIBIE_AQ_FLAG_RD (Sashiko)
> - fix the ice function reference: the kmemdup()-based backup lives in
>   ice_sq_send_cmd_retry(), not ice_sq_send_cmd() (Sashiko)
> 
>  drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c | 7 +++----
>  1 file changed, 3 insertions(+), 4 deletions(-)

Tested-by: Alexander Nowlin <alexander.nowlin@xxxxxxxxx>