[PATCH] ice: fix pktgen crash in eswitch mode

From: Lorenz Brun

Date: Fri Sep 25 2026 - 18:27:10 EST


When pktgen reuses an skb on an ICE port representor, the representor
forwards it to the uplink through dev_queue_xmit(). If the lower qdisc
retains the skb, a subsequent transmission of the same skb overwrites
its list pointers. Dequeuing it from qdisc->gso_skb then dereferences a
NULL skb->next in __skb_unlink().

Disable SKB reuse for this ice path to prevent this.

Crash signature:
__dev_queue_xmit+0x5c9/0xf20
ice_eswitch_port_start_xmit+0x83/0xd0 [ice]
pktgen_thread_worker+0x82f/0x1c10 [pktgen]

Signed-off-by: Lorenz Brun <lorenz@xxxxxxxxxxxx>
---
drivers/net/ethernet/intel/ice/ice_repr.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/intel/ice/ice_repr.c b/drivers/net/ethernet/intel/ice/ice_repr.c
index 096566c697f4..2603cb0f6a54 100644
--- a/drivers/net/ethernet/intel/ice/ice_repr.c
+++ b/drivers/net/ethernet/intel/ice/ice_repr.c
@@ -305,6 +305,7 @@ ice_repr_reg_netdev(struct net_device *netdev, const struct net_device_ops *ops)
eth_hw_addr_random(netdev);
netdev->netdev_ops = ops;
ice_set_ethtool_repr_ops(netdev);
+ netdev->priv_flags &= ~IFF_TX_SKB_SHARING;

netdev->hw_features |= NETIF_F_HW_TC;

--
2.54.0