On Sat, Feb 14, 2026 at 07:14:25PM +0000, Kohei Enju wrote:
> iavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the
> value could change in runtime, we should use num_tx_queues instead.
>
> Moreover iavf_get_ethtool_stats() uses num_active_queues while
> iavf_get_sset_count() and iavf_get_stat_strings() use
> real_num_tx_queues, which triggers out-of-bounds writes when we do
> "ethtool -L" and "ethtool -S" simultaneously [1].
>
> For example when we change channels from 1 to 8, Thread 3 could be
> scheduled before Thread 2, and out-of-bounds writes could be triggered
> in Thread 3:
>
> Thread 1 (ethtool -L) Thread 2 (work) Thread 3 (ethtool -S)
> iavf_set_channels()
> ...
> iavf_alloc_queues()
> -> num_active_queues = 8
> iavf_schedule_finish_config()
> iavf_get_sset_count()
> real_num_tx_queues: 1
> -> buffer for 1 queue
> iavf_get_ethtool_stats()
> num_active_queues: 8
> -> out-of-bounds!
> iavf_finish_config()
> -> real_num_tx_queues = 8
...
> Fixes: 64430f70ba6f ("iavf: Fix displaying queue statistics shown by ethtool")
> Signed-off-by: Kohei Enju <[email protected]>
...
> @@ -345,19 +344,19 @@ static void iavf_get_ethtool_stats(struct net_device
> *netdev,
> iavf_add_ethtool_stats(&data, adapter, iavf_gstrings_stats);
>
> rcu_read_lock();
> - /* As num_active_queues describe both tx and rx queues, we can use
> - * it to iterate over rings' stats.
> + /* Use num_tx_queues to report stats for the maximum number of queues.
> + * Queues beyond num_active_queues will report zero.
> */
> - for (i = 0; i < adapter->num_active_queues; i++) {
> - struct iavf_ring *ring;
> + for (i = 0; i < netdev->num_tx_queues; i++) {
> + struct iavf_ring *tx_ring = NULL, *rx_ring = NULL;
>
> - /* Tx rings stats */
> - ring = &adapter->tx_rings[i];
> - iavf_add_queue_stats(&data, ring);
> + if (i < adapter->num_active_queues) {
Hi Enju-san,
If I understand things correctly, in the scenario described in the patch
description, num_active_queues will be 8 here.
Won't that result in an overflow?
> + tx_ring = &adapter->tx_rings[i];
> + rx_ring = &adapter->rx_rings[i];
> + }
>
> - /* Rx rings stats */
> - ring = &adapter->rx_rings[i];
> - iavf_add_queue_stats(&data, ring);
> + iavf_add_queue_stats(&data, tx_ring);
> + iavf_add_queue_stats(&data, rx_ring);
> }
> rcu_read_unlock();
> }
...
