[Intel-wired-lan] [PATCH v1 iwl-net] iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
Paul Menzel
pmenzel at molgen.mpg.de
Wed Feb 18 08:00:33 UTC 2026
Dear Kohei,
Thank you for your patch.
Am 14.02.26 um 20:14 schrieb Kohei Enju:
> iavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the
> value could change in runtime, we should use num_tx_queues instead.
>
> Moreover iavf_get_ethtool_stats() uses num_active_queues while
> iavf_get_sset_count() and iavf_get_stat_strings() use
> real_num_tx_queues, which triggers out-of-bounds writes when we do
> "ethtool -L" and "ethtool -S" simultaneously [1].
>
> For example when we change channels from 1 to 8, Thread 3 could be
> scheduled before Thread 2, and out-of-bounds writes could be triggered
> in Thread 3:
>
> Thread 1 (ethtool -L) Thread 2 (work) Thread 3 (ethtool -S)
> iavf_set_channels()
> ...
> iavf_alloc_queues()
> -> num_active_queues = 8
> iavf_schedule_finish_config()
> iavf_get_sset_count()
> real_num_tx_queues: 1
> -> buffer for 1 queue
> iavf_get_ethtool_stats()
> num_active_queues: 8
> -> out-of-bounds!
> iavf_finish_config()
> -> real_num_tx_queues = 8
>
> Use immutable num_tx_queues in all related functions to avoid the issue.
>
> [1]
> BUG: KASAN: vmalloc-out-of-bounds in iavf_add_one_ethtool_stat+0x200/0x270
> Write of size 8 at addr ffffc900031c9080 by task ethtool/5800
>
> CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full)
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> Call Trace:
> <TASK>
> dump_stack_lvl+0x6f/0xb0
> print_report+0x170/0x4f3
> kasan_report+0xe1/0x180
> iavf_add_one_ethtool_stat+0x200/0x270
> iavf_get_ethtool_stats+0x14c/0x2e0
> __dev_ethtool+0x3d0c/0x5830
> dev_ethtool+0x12d/0x270
> dev_ioctl+0x53c/0xe30
> sock_do_ioctl+0x1a9/0x270
> sock_ioctl+0x3d4/0x5e0
> __x64_sys_ioctl+0x137/0x1c0
> do_syscall_64+0xf3/0x690
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f7da0e6e36d
> ...
> </TASK>
>
> The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900031c9000 allocated at __dev_ethtool+0x3cc9/0x5830
> The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000
> index:0xffff88813a013de0 pfn:0x13a013
> flags: 0x200000000000000(node=0|zone=2)
> raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000
> raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000
> page dumped because: kasan: bad access detected
>
> Memory state around the buggy address:
> ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
> ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> >ffffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
> ^
> ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
> ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
>
> Fixes: 64430f70ba6f ("iavf: Fix displaying queue statistics shown by ethtool")
> Signed-off-by: Kohei Enju <kohei at enjuk.jp>
> ---
> .../net/ethernet/intel/iavf/iavf_ethtool.c | 31 +++++++++----------
> 1 file changed, 15 insertions(+), 16 deletions(-)
>
> diff --git a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c
> index 6ff3842a1ff1..98bec3afc200 100644
> --- a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c
> +++ b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c
> @@ -313,14 +313,13 @@ static int iavf_get_sset_count(struct net_device *netdev, int sset)
> {
> /* Report the maximum number queues, even if not every queue is
> * currently configured. Since allocation of queues is in pairs,
> - * use netdev->real_num_tx_queues * 2. The real_num_tx_queues is set
> - * at device creation and never changes.
> + * use netdev->num_tx_queues * 2. The num_tx_queues is set at
> + * device creation and never changes.
> */
>
> if (sset == ETH_SS_STATS)
> return IAVF_STATS_LEN +
> - (IAVF_QUEUE_STATS_LEN * 2 *
> - netdev->real_num_tx_queues);
> + (IAVF_QUEUE_STATS_LEN * 2 * netdev->num_tx_queues);
> else
> return -EINVAL;
> }
> @@ -345,19 +344,19 @@ static void iavf_get_ethtool_stats(struct net_device *netdev,
> iavf_add_ethtool_stats(&data, adapter, iavf_gstrings_stats);
>
> rcu_read_lock();
> - /* As num_active_queues describe both tx and rx queues, we can use
> - * it to iterate over rings' stats.
> + /* Use num_tx_queues to report stats for the maximum number of queues.
> + * Queues beyond num_active_queues will report zero.
> */
> - for (i = 0; i < adapter->num_active_queues; i++) {
> - struct iavf_ring *ring;
> + for (i = 0; i < netdev->num_tx_queues; i++) {
> + struct iavf_ring *tx_ring = NULL, *rx_ring = NULL;
>
> - /* Tx rings stats */
> - ring = &adapter->tx_rings[i];
> - iavf_add_queue_stats(&data, ring);
> + if (i < adapter->num_active_queues) {
> + tx_ring = &adapter->tx_rings[i];
> + rx_ring = &adapter->rx_rings[i];
> + }
>
> - /* Rx rings stats */
> - ring = &adapter->rx_rings[i];
> - iavf_add_queue_stats(&data, ring);
> + iavf_add_queue_stats(&data, tx_ring);
> + iavf_add_queue_stats(&data, rx_ring);
> }
> rcu_read_unlock();
> }
> @@ -376,9 +375,9 @@ static void iavf_get_stat_strings(struct net_device *netdev, u8 *data)
> iavf_add_stat_strings(&data, iavf_gstrings_stats);
>
> /* Queues are always allocated in pairs, so we just use
> - * real_num_tx_queues for both Tx and Rx queues.
> + * num_tx_queues for both Tx and Rx queues.
> */
> - for (i = 0; i < netdev->real_num_tx_queues; i++) {
> + for (i = 0; i < netdev->num_tx_queues; i++) {
> iavf_add_stat_strings(&data, iavf_gstrings_queue_stats,
> "tx", i);
> iavf_add_stat_strings(&data, iavf_gstrings_queue_stats,
Reviewed-by: Paul Menzel <pmenzel at molgen.mpg.de>
Kind regards,
Paul
More information about the Intel-wired-lan
mailing list