Re: [PATCH net-next v2 5/8] eth: mpnic: start and stop the Tx HW queues

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] eth: mpnic: swallowed queue idle timeout allows DMA UAF
--

commit 9b058fd2b1d09b6f8ce72863ddb8a3c9c658d5a3
Author: Daniel Zahka <daniel.zahka@gmail.com>

eth: mpnic: start and stop the Tx HW queues

This commit adds the routines to start and stop the transmit hardware queues
for the mpnic device. It provides functions to point the hardware at the
descriptor rings and wait for the DMA engines to become idle during teardown.

> diff --git a/drivers/net/ethernet/meta/mpnic/mpnic_txrx.c b/drivers/net/ethernet/meta/mpnic/mpnic_txrx.c
> index 853976e11b032..aaa3a3e99a138 100644
> --- a/drivers/net/ethernet/meta/mpnic/mpnic_txrx.c
> +++ b/drivers/net/ethernet/meta/mpnic/mpnic_txrx.c

[ ... ]

> +void mpnic_wait_all_queues_idle(struct mpnic_dev *mpd)
> +{
> +	static const struct mpnic_idle_regs queues[] = {
> +		{ MPNIC_TWQ_IDLE(0), MPNIC_TWQ_IDLE_CNT, "TWQ" },
> +		{ MPNIC_TQS_IDLE(0), MPNIC_TQS_IDLE_CNT, "TQS" },
> +		{ MPNIC_TDE_IDLE(0), MPNIC_TDE_IDLE_CNT, "TDE" },
> +		{ MPNIC_TCQ_IDLE(0), MPNIC_TCQ_IDLE_CNT, "TCQ" },
> +	};
> +	u32 non_idle_bitmap;
> +	int err;
> +
> +	err = read_poll_timeout(mpnic_non_idle_queues, non_idle_bitmap,
> +				!non_idle_bitmap, 20, 500000, false, mpd,
> +				queues, ARRAY_SIZE(queues));
> +	if (err)
> +		mpnic_idle_dump(mpd, queues, ARRAY_SIZE(queues),
> +				non_idle_bitmap, err);

[Severity: High]
Does this code silently ignore the timeout from read_poll_timeout()?

If the hardware is stalled or under heavy load, read_poll_timeout() times out
after 500ms. Because mpnic_wait_all_queues_idle() returns void, it logs the
error but hides it from the caller during interface teardown.

Could the caller blindly proceed to free the ring memory back to the page
allocator while the active hardware is still performing DMA transfers into it,
causing a DMA use-after-free?

Should the error be propagated so the driver can leak the memory or trigger
a hardware reset rather than risking memory corruption?

> +}
> +
> +void mpnic_flush(struct mpnic_net *mpn)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260924-linux-mpnic-v2-0-4badc9b58b9e@gmail.com?part=5