Re: [PATCH net-next v5 3/4] net: mana: support concurrent HWC requests

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Preexisting use-after-free of `hwc_cq->comp_buf` during HWC CQ destruction due to a race with the interrupt handler.
--

commit a87caaea6f635bdcf7c331ad2a7a65f2ff025635
Author: Long Li <longli@microsoft.com>
Subject: net: mana: support concurrent HWC requests

This commit serializes SQ posting and protects HWC lookup and sender accounting
with hwc_lock. Teardown now stops admission, force-completes requests, and
drains senders before destroying the CQ, TXQ, and RXQ.

> diff --git a/drivers/net/ethernet/microsoft/mana/hw_channel.c b/drivers/net/ethernet/microsoft/mana/hw_channel.c
> index 6605e7a9c481b..a4f7346d285f7 100644
> --- a/drivers/net/ethernet/microsoft/mana/hw_channel.c
> +++ b/drivers/net/ethernet/microsoft/mana/hw_channel.c
[ ... ]
> @@ -864,14 +974,28 @@ void mana_hwc_destroy_channel(struct gdma_context *gc)
>  	}
>  	gc->max_num_cqs = 0;
>  
> +	/* Deregister the HWC EQ before freeing the work queues. */
> +	if (hwc->cq)
> +		mana_hwc_destroy_cq(hwc->gdma_dev->gdma_context, hwc->cq);
> +

[Severity: High]
This is a pre-existing issue, but since this patch moves the call to
mana_hwc_destroy_cq(), is it worth fixing a use-after-free bug in that
function's teardown path?

In mana_hwc_destroy_cq(), hwc_cq->comp_buf is freed before the EQ is
destroyed:

mana_hwc_destroy_cq() {
	kfree(hwc_cq->comp_buf);

	if (hwc_cq->gdma_cq)
		mana_gd_destroy_queue(gc, hwc_cq->gdma_cq);

	if (hwc_cq->gdma_eq)
		mana_gd_destroy_queue(gc, hwc_cq->gdma_eq);
	...
}

Because mana_gd_destroy_queue() on the EQ is what performs synchronize_rcu()
to wait for concurrent interrupt handlers to finish, a racing interrupt
handler on another CPU could still execute mana_hwc_comp_event() after the
buffer is freed:

mana_hwc_comp_event() {
	...
	completions = hwc_cq->comp_buf;
	comp_read = mana_gd_poll_cq(q_self, completions, hwc_cq->queue_depth);
	...
}

Could this lead to a use-after-free and memory corruption when
mana_gd_poll_cq() writes hardware completion events into the freed
completions buffer?

>  	if (hwc->txq)
>  		mana_hwc_destroy_wq(hwc, hwc->txq);
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260908035201.402424-1-longli@microsoft.com?part=3