[PATCH] ice: fix double dereference in TP_printk problems in ice_{rx,tx}_dim_template

Stefan Metzmacher posted 1 patch 2 weeks, 4 days ago
drivers/net/ethernet/intel/ice/ice_trace.h | 44 +++++++++++-----------
1 file changed, 22 insertions(+), 22 deletions(-)
[PATCH] ice: fix double dereference in TP_printk problems in ice_{rx,tx}_dim_template
Posted by Stefan Metzmacher 2 weeks, 4 days ago
ice_tx_dim_work and ice_rx_dim_work generate the
following: "has double dereference in TP_printk" errors:

 REC->q_vector->tx.tx_ring->q_index
 REC->dim->state
 REC->dim->profile_ix
 REC->dim->tune_state
 REC->dim->steps_right
 REC->dim->steps_left
 REC->dim->tired

And the first one hits a WARN_ONCE()...

Fixes: 3089cf6d3caa ("ice: add tracepoints")
Cc: Tony Nguyen <anthony.l.nguyen@intel.com>
Cc: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Cc: Andrew Lunn <andrew+netdev@lunn.ch>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: intel-wired-lan@lists.osuosl.org
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Stefan Metzmacher <metze@samba.org>
---
 drivers/net/ethernet/intel/ice/ice_trace.h | 44 +++++++++++-----------
 1 file changed, 22 insertions(+), 22 deletions(-)

diff --git a/drivers/net/ethernet/intel/ice/ice_trace.h b/drivers/net/ethernet/intel/ice/ice_trace.h
index 4f35ef8d6b29..c641f8ce1aff 100644
--- a/drivers/net/ethernet/intel/ice/ice_trace.h
+++ b/drivers/net/ethernet/intel/ice/ice_trace.h
@@ -63,23 +63,23 @@
 DECLARE_EVENT_CLASS(ice_rx_dim_template,
 		    TP_PROTO(struct ice_q_vector *q_vector, struct dim *dim),
 		    TP_ARGS(q_vector, dim),
-		    TP_STRUCT__entry(__field(struct ice_q_vector *, q_vector)
-				     __field(struct dim *, dim)
+		    TP_STRUCT__entry(__field(u16, q_index)
+				     __field_struct(struct dim, dim)
 				     __string(devname, q_vector->rx.rx_ring->netdev->name)),
 
-		    TP_fast_assign(__entry->q_vector = q_vector;
-				   __entry->dim = dim;
+		    TP_fast_assign(__entry->q_index = q_vector->rx.rx_ring->q_index;
+				   memcpy(&__entry->dim, dim, sizeof(__entry->dim));
 				   __assign_str(devname);),
 
 		    TP_printk("netdev: %s Rx-Q: %d dim-state: %d dim-profile: %d dim-tune: %d dim-st-right: %d dim-st-left: %d dim-tired: %d",
 			      __get_str(devname),
-			      __entry->q_vector->rx.rx_ring->q_index,
-			      __entry->dim->state,
-			      __entry->dim->profile_ix,
-			      __entry->dim->tune_state,
-			      __entry->dim->steps_right,
-			      __entry->dim->steps_left,
-			      __entry->dim->tired)
+			      __entry->q_index,
+			      __entry->dim.state,
+			      __entry->dim.profile_ix,
+			      __entry->dim.tune_state,
+			      __entry->dim.steps_right,
+			      __entry->dim.steps_left,
+			      __entry->dim.tired)
 );
 
 DEFINE_EVENT(ice_rx_dim_template, ice_rx_dim_work,
@@ -90,23 +90,23 @@ DEFINE_EVENT(ice_rx_dim_template, ice_rx_dim_work,
 DECLARE_EVENT_CLASS(ice_tx_dim_template,
 		    TP_PROTO(struct ice_q_vector *q_vector, struct dim *dim),
 		    TP_ARGS(q_vector, dim),
-		    TP_STRUCT__entry(__field(struct ice_q_vector *, q_vector)
-				     __field(struct dim *, dim)
+		    TP_STRUCT__entry(__field(u16, q_index)
+				     __field_struct(struct dim, dim)
 				     __string(devname, q_vector->tx.tx_ring->netdev->name)),
 
-		    TP_fast_assign(__entry->q_vector = q_vector;
-				   __entry->dim = dim;
+		    TP_fast_assign(__entry->q_index = q_vector->tx.tx_ring->q_index;
+				   memcpy(&__entry->dim, dim, sizeof(__entry->dim));
 				   __assign_str(devname);),
 
 		    TP_printk("netdev: %s Tx-Q: %d dim-state: %d dim-profile: %d dim-tune: %d dim-st-right: %d dim-st-left: %d dim-tired: %d",
 			      __get_str(devname),
-			      __entry->q_vector->tx.tx_ring->q_index,
-			      __entry->dim->state,
-			      __entry->dim->profile_ix,
-			      __entry->dim->tune_state,
-			      __entry->dim->steps_right,
-			      __entry->dim->steps_left,
-			      __entry->dim->tired)
+			      __entry->q_index,
+			      __entry->dim.state,
+			      __entry->dim.profile_ix,
+			      __entry->dim.tune_state,
+			      __entry->dim.steps_right,
+			      __entry->dim.steps_left,
+			      __entry->dim.tired)
 );
 
 DEFINE_EVENT(ice_tx_dim_template, ice_tx_dim_work,
-- 
2.43.0
Re: [PATCH] ice: fix double dereference in TP_printk problems in ice_{rx,tx}_dim_template
Posted by Tony Nguyen 2 weeks, 1 day ago

On 9/7/2026 9:48 AM, Stefan Metzmacher wrote:
> ice_tx_dim_work and ice_rx_dim_work generate the
> following: "has double dereference in TP_printk" errors:
> 
>   REC->q_vector->tx.tx_ring->q_index
>   REC->dim->state
>   REC->dim->profile_ix
>   REC->dim->tune_state
>   REC->dim->steps_right
>   REC->dim->steps_left
>   REC->dim->tired

Thanks for the patch Stefan but Jakub has already submitted a patch [1] 
that's en route to fix this.

Thanks,
Tony

[1] 
https://lore.kernel.org/intel-wired-lan/aqFp78nsYmT8gRDO@gmail.com/T/#ma04a6a8301063209e8eae383e31293953f4eba46 

> And the first one hits a WARN_ONCE()...
> 
> Fixes: 3089cf6d3caa ("ice: add tracepoints")
> Cc: Tony Nguyen <anthony.l.nguyen@intel.com>
> Cc: Przemek Kitszel <przemyslaw.kitszel@intel.com>
> Cc: Andrew Lunn <andrew+netdev@lunn.ch>
> Cc: "David S. Miller" <davem@davemloft.net>
> Cc: Eric Dumazet <edumazet@google.com>
> Cc: Jakub Kicinski <kuba@kernel.org>
> Cc: Paolo Abeni <pabeni@redhat.com>
> Cc: intel-wired-lan@lists.osuosl.org
> Cc: netdev@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> Signed-off-by: Stefan Metzmacher <metze@samba.org>