Re: [PATCH net-next] net: mana: Add CQE polling as first-level TX timeout recovery

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Critical] net: mana: missing netdev_lock() in mana_detach() callers
  [1]
--

commit 6f4e15a96596e896188b6e028bb49a0d4c04269b
Author: Sahil Chandna <sahilchandna@linux.microsoft.com>

net: mana: Add CQE polling as first-level TX timeout recovery

This commit adds a first-level TX timeout recovery mechanism that polls
the stalled queue's TX CQ via napi_schedule() before escalating to a
port-level queue reset.

> diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c
> index e6d494df22e4d..0d8c8b8fbc83f 100644
> --- a/drivers/net/ethernet/microsoft/mana/mana_en.c
> +++ b/drivers/net/ethernet/microsoft/mana/mana_en.c
> @@ -336,6 +336,9 @@ static void mana_per_port_queue_reset_work_handler(struct work_struct *work)
>  	if (err)
>  		netdev_err(ndev, "mana_attach failed: %d\n", err);
>  
> +	/* Let the next TX timeout try a CQE poll recovery first */
> +	WRITE_ONCE(apc->last_tx_timeout, 0);

[Severity: Critical]
This problem wasn't introduced by this patch, but should
mana_per_port_queue_reset_work_handler() (along with mana_remove(),
mana_probe() on resume, and mana_xdp_set()) hold netdev_lock(ndev) around
mana_detach() and mana_attach() [1]?

Because mana_devops sets .net_shaper_ops, netdev_need_ops_lock() is
enabled on MANA net_device instances.  Queue teardown in mana_detach()
calls napi_disable_locked() and netif_napi_del_locked() via
mana_destroy_txq() and mana_destroy_rxq(), while mana_attach() calls
netif_napi_add_locked(), netif_napi_add_weight_locked(), and
napi_enable_locked().  Calling these under rtnl_lock() alone violates
netdev_assert_locked(), leaves NAPI state unserialized against netdev-genl
operations, and allows ops-locked ethtool callbacks (such as
mana_get_ethtool_stats() or mana_set_coalesce()) running under
netdev_lock() without rtnl_lock() to race with apc->rxqs and apc->tx_qp
teardown, leading to a use-after-free or NULL pointer dereference.

[1] https://sashiko.dev/#/bug/linux-2946b7e7-6855-49c0-921d-a6daa482c10c

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112105752.978446-1-sahilchandna@linux.microsoft.com?part=1