[PATCH v2 1/3] net/iavf: fix crash in Tx drain on PF reset

[Bruce Richardson]

On Wed, Nov 04, 2026 at 09:55:07AM +0000, Ciara Loftus wrote:
> The Tx cleanup helpers check the DD bit of the descriptor at the next
> RS boundary and assume software has already posted it. The burst path
> guarantees this by only cleaning up when nb_tx_free drops below
> tx_free_thresh, but iavf_dev_tx_drain() called the helpers on any
> non-empty queue.
> 
> With fewer than tx_rs_thresh descriptors outstanding, that descriptor
> still held the DESC_DONE value set by reset_tx_queue(), so the helpers
> treated the block as complete and freed NULL (or already freed) mbufs,
> crashing on PF reset.
> 
> Only clean up a queue once a full RS block is outstanding.
> 
> Fixes: 30e1aab01bae ("net/iavf: drain in-flight Tx before reset")
> Cc: stable at dpdk.org
> 
> Signed-off-by: Ciara Loftus <ciara.loftus at intel.com>
> ---
>  drivers/net/intel/iavf/iavf_rxtx.c | 8 +++-----
>  1 file changed, 3 insertions(+), 5 deletions(-)
> 
Acked-by: Bruce Richardson <bruce.richardson at intel.com>