From 4f20c628b62eb86babdc28cbd1befa6bd858a62d Mon Sep 17 00:00:00 2001 From: Jian Shen Date: Fri, 7 Aug 2026 17:54:33 +0800 Subject: [PATCH 1/3] net: hns3: set msg->desc to NULL after kfree in hclge_query_reg_info() In hclge_query_reg_info(), msg->desc is freed by kfree(), but the caller continues to use msg across loop iterations. Set msg->desc to NULL to avoid leaving a dangling pointer in the reused struct. Signed-off-by: Jian Shen Signed-off-by: Jijie Shao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260807095435.2959246-2-shaojijie@huawei.com Signed-off-by: Paolo Abeni --- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c index dac051e798da..7e124e2c718d 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c @@ -1592,6 +1592,7 @@ hclge_query_reg_info(struct hclge_dev *hdev, } kfree(msg->desc); + msg->desc = NULL; } static void hclge_query_reg_info_of_ssu(struct hclge_dev *hdev) From b8f554e13899fe2635a59f0260eec9a047247009 Mon Sep 17 00:00:00 2001 From: Jijie Shao Date: Fri, 7 Aug 2026 17:54:34 +0800 Subject: [PATCH 2/3] net: hns3: add missing const qualifier to hclge_log_error() reg parameter The reg parameter of hclge_log_error() is never modified within the function, but is declared as 'char *'. Callers pass const strings, causing a compiler warning about discarding the 'const' qualifier. Add the missing const to fix the warning. Signed-off-by: Jijie Shao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260807095435.2959246-3-shaojijie@huawei.com Signed-off-by: Paolo Abeni --- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c index 7e124e2c718d..6093a60d257b 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c @@ -1762,7 +1762,7 @@ static const struct hclge_hw_type_id hclge_hw_type_id_st[] = { }, }; -static void hclge_log_error(struct device *dev, char *reg, +static void hclge_log_error(struct device *dev, const char *reg, const struct hclge_hw_error *err, u32 err_sts, unsigned long *reset_requests) { From f57b277e8b6f6e6d3bc082be6b67c6bec02d5cbd Mon Sep 17 00:00:00 2001 From: Jian Shen Date: Fri, 7 Aug 2026 17:54:35 +0800 Subject: [PATCH 3/3] net: hns3: use txqueue parameter directly in ndo_tx_timeout The ndo_tx_timeout callback already provides the timed out txqueue index. Use it directly instead of iterating all tx queues to find the timed out one. Use h->kinfo.num_tqps for the bounds check instead of ndev->num_tx_queues, as the ring array is allocated with num_tqps entries and num_tx_queues may be larger. This issue has not been encountered in practice, so it is folded into this cleanup rather than tracked as a separate bugfix. Signed-off-by: Jian Shen Signed-off-by: Jijie Shao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260807095435.2959246-4-shaojijie@huawei.com Signed-off-by: Paolo Abeni --- .../net/ethernet/hisilicon/hns3/hns3_enet.c | 48 +++++++++---------- 1 file changed, 22 insertions(+), 26 deletions(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c index 6ecb32e28e79..47788be64be6 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c @@ -2825,32 +2825,28 @@ static int hns3_nic_change_mtu(struct net_device *netdev, int new_mtu) return ret; } -static int hns3_get_timeout_queue(struct net_device *ndev) +static bool hns3_dump_timeout_queue(struct net_device *ndev, + unsigned int txqueue) { - unsigned int i; + unsigned int timedout_ms; + struct netdev_queue *q; - /* Find the stopped queue the same way the stack does */ - for (i = 0; i < ndev->num_tx_queues; i++) { - unsigned int timedout_ms; - struct netdev_queue *q; - - q = netdev_get_tx_queue(ndev, i); - timedout_ms = netif_xmit_timeout_ms(q); - if (timedout_ms) { + q = netdev_get_tx_queue(ndev, txqueue); + timedout_ms = netif_xmit_timeout_ms(q); + if (timedout_ms) { #ifdef CONFIG_BQL - struct dql *dql = &q->dql; + struct dql *dql = &q->dql; - netdev_info(ndev, "DQL info last_cnt: %u, queued: %u, adj_limit: %u, completed: %u\n", - dql->last_obj_cnt, dql->num_queued, - dql->adj_limit, dql->num_completed); + netdev_info(ndev, "DQL info last_cnt: %u, queued: %u, adj_limit: %u, completed: %u\n", + dql->last_obj_cnt, dql->num_queued, + dql->adj_limit, dql->num_completed); #endif - netdev_info(ndev, "queue state: 0x%lx, delta msecs: %u\n", - q->state, timedout_ms); - break; - } + netdev_info(ndev, "queue state: 0x%lx, delta msecs: %u\n", + q->state, timedout_ms); + return true; } - return i; + return false; } static void hns3_dump_queue_stats(struct net_device *ndev, @@ -2900,15 +2896,15 @@ static void hns3_dump_queue_reg(struct net_device *ndev, HNS3_RING_TX_RING_EBD_OFFSET_REG)); } -static bool hns3_get_tx_timeo_queue_info(struct net_device *ndev) +static bool hns3_get_tx_timeo_queue_info(struct net_device *ndev, + unsigned int txqueue) { struct hns3_nic_priv *priv = netdev_priv(ndev); struct hnae3_handle *h = hns3_get_handle(ndev); struct hns3_enet_ring *tx_ring; - u32 timeout_queue; - timeout_queue = hns3_get_timeout_queue(ndev); - if (timeout_queue >= ndev->num_tx_queues) { + if (txqueue >= h->kinfo.num_tqps || + !hns3_dump_timeout_queue(ndev, txqueue)) { netdev_info(ndev, "no netdev TX timeout queue found, timeout count: %llu\n", priv->tx_timeout_count); @@ -2917,8 +2913,8 @@ static bool hns3_get_tx_timeo_queue_info(struct net_device *ndev) priv->tx_timeout_count++; - tx_ring = &priv->ring[timeout_queue]; - hns3_dump_queue_stats(ndev, tx_ring, timeout_queue); + tx_ring = &priv->ring[txqueue]; + hns3_dump_queue_stats(ndev, tx_ring, txqueue); /* When mac received many pause frames continuous, it's unable to send * packets, which may cause tx timeout @@ -2941,7 +2937,7 @@ static void hns3_nic_net_timeout(struct net_device *ndev, unsigned int txqueue) struct hns3_nic_priv *priv = netdev_priv(ndev); struct hnae3_handle *h = priv->ae_handle; - if (!hns3_get_tx_timeo_queue_info(ndev)) + if (!hns3_get_tx_timeo_queue_info(ndev, txqueue)) return; /* request the reset, and let the hclge to determine