Re: [PATCH v16 net-next 1/2] octeontx2: use atomic bitops for PF/VF and rep flags

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] net: torn state race condition in otx2_sync_flags_from_rep()
--

commit efc39444848abda6ed3d0dfe8f808dc182225903
Author: Ratheesh Kannoth <rkannoth@marvell.com>

octeontx2: use atomic bitops for PF/VF and rep flags

Replace non-atomic u64 flag read-modify-write with unsigned long bitmaps
and set_bit/clear_bit/test_bit access across the NIC driver. Add otx2 flag
helpers and representor state sync functionality.

> diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
> --- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
> +++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h

[ ... ]

> +static inline void otx2_sync_flags_from_rep(struct otx2_nic *dst,
> +					    unsigned long *src_flags)
> +{
> +	unsigned int flag;
> +
> +	for (flag = 0; flag < OTX2_FLAG_MAX; flag++) {
> +		if (test_bit(flag, src_flags))
> +			set_bit(flag, &dst->flags);
> +		else
> +			clear_bit(flag, &dst->flags);
> +	}

[Severity: Medium]
Could this bit-by-bit synchronization cause a torn state for concurrent
readers?

When this loops over OTX2_FLAG_MAX bits, executing set_bit() or clear_bit()
individually, it breaks a single mask synchronization into multiple separate
atomic operations.

Concurrent fast-path readers executing otx2_tx_napi_handler() or
otx2_rcv_pkt_handler() might check pfvf->flags concurrently (for example,
OTX2_FLAG_REP_MODE_ENABLED or OTX2_FLAG_TC_MARK_ENABLED). Might they observe
an inconsistent combination of old and new flags during this loop?

This seems reachable if userspace configures TC rules on representors while
traffic is actively flowing, triggering rvu_rep_setup_tc_cb() to update the
shared structure.

> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260918015906.1255204-1-rkannoth@marvell.com?part=1