Re: [PATCH v2 net-next 09/12] net: enetc: add CBDR setup/teardown hooks to enetc_si_ops for VF support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing PCIe posted write flush during CBDR teardown leads to potential DMA use-after-free/fault
--

commit e8719566bfcc671815aca75ea6a2c0caefb79aef
Author: Wei Fang <wei.fang@nxp.com>

net: enetc: add CBDR setup/teardown hooks to enetc_si_ops for VF support

This commit adds setup_cbdr and teardown_cbdr function pointers to struct
enetc_si_ops to allow the ENETC v1 and v4 VF drivers to register their own
command BD ring implementations. It updates the VF driver to call these
operations through the ops structure instead of invoking the v1 functions
directly, enabling runtime selection based on the hardware version.

> diff --git a/drivers/net/ethernet/freescale/enetc/enetc_vf.c b/drivers/net/ethernet/freescale/enetc/enetc_vf.c
> index e8ad5ad5aba48..9cdb0a4d6bafb 100644
> --- a/drivers/net/ethernet/freescale/enetc/enetc_vf.c
> +++ b/drivers/net/ethernet/freescale/enetc/enetc_vf.c
> @@ -288,6 +288,8 @@ static void enetc_vf_netdev_setup(struct enetc_si *si, struct net_device *ndev,
>  static const struct enetc_si_ops enetc_vsi_ops = {
>  	.get_rss_table = enetc_get_rss_table,
>  	.set_rss_table = enetc_set_rss_table,
> +	.setup_cbdr = enetc_setup_cbdr,
> +	.teardown_cbdr = enetc_teardown_cbdr,

[Severity: High]
This is a pre-existing issue, but looking at the implementation of
enetc_teardown_cbdr(), the command ring is disabled by writing 0 to the
Mode Register. Because this write translates to an iowrite32, it is a
posted PCIe write that can be delayed in the interconnect fabric.

The code then frees the DMA memory immediately without reading back from
a device register to flush the posted write, and without polling for a
hardware busy status to clear.

If a previous command timed out and the hardware is still processing it,
or if the posted write is simply delayed, could the device continue
accessing the descriptor ring after the memory is unmapped? This might
result in an IOMMU fault or silent memory corruption if the IOMMU is
disabled.

>  };

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260522092438.1264020-1-wei.fang@nxp.com?part=9