Re: [PATCH net-next 04/15] net: enetc: add link speed message support to PF driver

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] An unprivileged VF can flood the PF with `ENETC_MSG_GET_CURRENT_LINK_SPEED` messages to cause global `rtnl_lock` contention, leading to a host-wide control-plane Denial of Service.
--

commit 3eea0a03e4cdfef39b34f0bcd2ee86ea5e1372eb
Author: Wei Fang <wei.fang@nxp.com>

net: enetc: add link speed message support to PF driver

This commit adds link speed message support to the PF driver for DPDK-owned
VFs. The PF can now reply with the current link speed when queried by a VF,
improving synchronization and performance adjustments in the VF-side
applications.

> diff --git a/drivers/net/ethernet/freescale/enetc/enetc_msg.c b/drivers/net/ethernet/freescale/enetc/enetc_msg.c
> index c93b4e6913d86..49c1ca14735c9 100644
> --- a/drivers/net/ethernet/freescale/enetc/enetc_msg.c
> +++ b/drivers/net/ethernet/freescale/enetc/enetc_msg.c

[ ... ]

> +static u16 enetc_msg_get_link_speed(struct enetc_pf *pf)
> +{
> +	struct enetc_ndev_priv *priv = netdev_priv(pf->si->ndev);
> +	struct ethtool_link_ksettings link_info = {};
> +	u16 pf_msg;
> +
> +	pf_msg = FIELD_PREP(ENETC_PF_MSG_CLASS_ID,
> +			    ENETC_MSG_CLASS_ID_LINK_SPEED);
> +
> +	rtnl_lock();
> +	if (phylink_ethtool_ksettings_get(priv->phylink, &link_info)) {
> +		pf_msg |= ENETC_PF_MSG_SPEED(ENETC_MSG_SPEED_UNKNOWN);
> +		rtnl_unlock();
> +
> +		return pf_msg;
> +	}
> +	rtnl_unlock();

[Severity: High]
Can an unprivileged VF flood the PF with ENETC_MSG_GET_CURRENT_LINK_SPEED
messages to cause global rtnl_lock contention?

Because enetc_msg_get_link_speed() unconditionally acquires the global
rtnl_lock() to query link settings in response to a VF request, a malicious
or malfunctioning guest could potentially spam these messages in a tight
loop. 

Could this severely starve other processes and VMs on the host that require
rtnl_lock for routine network configuration, resulting in a system-wide
control-plane denial of service?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260605065550.3038579-1-wei.fang@oss.nxp.com?part=4