)]}'
{
  "commit": "5db89c99566fc4728cc92e941d8e1975711e24b5",
  "tree": "b1a243fb398cff4c5aece2ecbe4e8fad76fab389",
  "parents": [
    "c6df9a65cbb0fe7808a4b2872095f4c849b3196a"
  ],
  "author": {
    "name": "Michael Bommarito",
    "email": "michael.bommarito@gmail.com",
    "time": "Wed May 13 21:37:39 2026 -0400"
  },
  "committer": {
    "name": "Jakub Kicinski",
    "email": "kuba@kernel.org",
    "time": "Thu May 14 18:40:04 2026 -0700"
  },
  "message": "net: ifb: report ethtool stats over num_tx_queues\n\nifb_dev_init() allocates dp-\u003etx_private to dev-\u003enum_tx_queues\nentries via kzalloc_objs(*txp, dev-\u003enum_tx_queues). Both IFB\nper-queue RX and TX stats live in those entries: ifb_xmit() updates\ntxp-\u003erx_stats using the skb queue mapping, ifb_ri_tasklet() updates\ntxp-\u003etx_stats, and ifb_stats64() aggregates both over\ndev-\u003enum_tx_queues.\n\nThe ethtool stats callbacks instead size and walk the per-queue\nstats with dev-\u003ereal_num_rx_queues and dev-\u003ereal_num_tx_queues. With\nan asymmetric device where the RX queue count exceeds the TX queue\ncount, for example:\n\n    ip link add name ifb10 numtxqueues 1 numrxqueues 8 type ifb\n    ethtool -S ifb10\n\nifb_get_ethtool_stats() indexes past the tx_private allocation and\ncopies adjacent slab data through ETHTOOL_GSTATS.\n\nUse dev-\u003enum_tx_queues consistently for the stats strings, the\nstats count, and the stats data walks. This reports one RX stats\ngroup and one TX stats group for each backing ifb_q_private entry,\nwhich is the queue set IFB can actually populate.\n\nReproduced under UML+KASAN at v7.1-rc2:\n\n  BUG: KASAN: slab-out-of-bounds in ifb_fill_stats_data+0x3c/0xae\n  Read of size 8 at addr 0000000062dbd228 by task ethtool/36\n  ifb_fill_stats_data+0x3c/0xae\n  ifb_get_ethtool_stats+0xc0/0x129\n  __dev_ethtool+0x1ca5/0x363c\n  dev_ethtool+0x123/0x1b3\n  dev_ioctl+0x56c/0x744\n  sock_do_ioctl+0x15f/0x1b2\n  sock_ioctl+0x4d5/0x50a\n  sys_ioctl+0xd8b/0xde9\n\nWith the patch applied, the same UML+KASAN repro is silent and\nethtool -S ifb10 reports only the stats backed by the single\nallocated tx_private entry.\n\nFixes: a21ee5b2fcb8 (\"net: ifb: support ethtools stats\")\nCc: stable@vger.kernel.org\nSigned-off-by: Michael Bommarito \u003cmichael.bommarito@gmail.com\u003e\nLink: https://patch.msgid.link/20260514013739.3549624-1-michael.bommarito@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "5407d2ed71b3531a0271344a03bf9e2d0d9fc1bd",
      "old_mode": 33188,
      "old_path": "drivers/net/ifb.c",
      "new_id": "43aa1bfd41cff23a02d67346ce8139b15c98e331",
      "new_mode": 33188,
      "new_path": "drivers/net/ifb.c"
    }
  ]
}