Re: [PATCH net-next v4 11/13] net: mana: keep a user-configured RSS table across a queue rebuild

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [High] Silent replacement of an invalid RSS table in `mana_alloc_queues` without notifying the ethtool core causes the table to be falsely treated as user-configured, permanently breaking default table auto-scaling.

Pre-existing issues:
- [High] Heap out-of-bounds read and write due to untrusted hardware configuration changing across resets.
--

commit 935252e88b1186422d52dcb7eb47455372ea3ed9
Author: Long Li <longli@microsoft.com>
Subject: net: mana: keep a user-configured RSS table across a queue rebuild

Preserve a user RSS table whenever all entries fit the requested queue
count. Regenerate driver defaults. On growth, a retained user table does
not steer RSS traffic to the added queues until the user updates it.

> diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c
> index fc96837d69a00..78be88b29c99b 100644
> --- a/drivers/net/ethernet/microsoft/mana/mana_en.c
> +++ b/drivers/net/ethernet/microsoft/mana/mana_en.c
> @@ -3548,6 +3548,27 @@ static void mana_rss_table_init(struct mana_port_context *apc)
>  			ethtool_rxfh_indir_default(i, apc->num_queues);
>  }
>  
> +/* Keep user tables with valid indices; defer loss notification. */
> +static bool mana_rss_table_keep(struct mana_port_context *apc,
> +				unsigned int num_queues, bool *lost)
> +{
> +	u32 i;
> +
> +	*lost = false;
> +
> +	if (!netif_is_rxfh_configured(apc->ndev))
> +		return false;
> +
> +	for (i = 0; i < apc->indir_table_sz; i++) {
> +		if (apc->indir_table[i] >= num_queues) {

[Severity: High]
This is a pre-existing issue, but can this out-of-bounds read occur if the
hardware configuration changes across resets?

If the hardware/firmware returns a larger num_indirection_ent during a
device reset (e.g., timeout recovery triggering mana_attach()),
mana_init_port() updates apc->indir_table_sz via mana_query_vport_cfg().
However, mana_attach() fails to reallocate apc->indir_table to accommodate
this potentially new size.

When mana_alloc_queues() is subsequently called, mana_rss_table_keep() and
mana_rss_table_init() iterate up to the new, larger apc->indir_table_sz,
causing an out-of-bounds read and write on the statically allocated buffer.

> +			*lost = true;
> +			return false;
> +		}
> +	}
> +
> +	return true;
> +}
> +

[ ... ]

> @@ -3863,7 +3885,9 @@ int mana_alloc_queues(struct net_device *ndev)
>  		goto destroy_rxq;
>  	}
>  
> -	mana_rss_table_init(apc);
> +	/* Loss notification needs a netdev instance lock we may lack. */
> +	if (!mana_rss_table_keep(apc, apc->num_queues, &indir_lost))
> +		mana_rss_table_init(apc);

[Severity: High]
Does this silent replacement of an invalid RSS table without notifying the
ethtool core permanently break default table auto-scaling?

If a user configures a custom RSS table, lowers the queue count while the
port is down, brings the port up, and then increases the queue count while
the port is up, the newly added queues might permanently receive no RSS
traffic.

Because the driver silently replaces the invalid custom table with a
smaller default table during the down/up cycle but fails to notify the
ethtool core (by intentionally omitting a call to ethtool_rxfh_indir_lost()),
the core remains desynchronized.

Later, when the queue count is increased, mana_grow_qset() falsely assumes
the small default table is the user's custom table and preserves it,
failing to scale the RSS indirection table to include the new queues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260908032843.397667-1-longli@microsoft.com?part=11