Re: [PATCH v4 net-next 08/15] net: enetc: move mac_filter from struct enetc_pf to struct enetc_si

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Fallback path in enetc_sync_mac_filters() reads corrupted hash bitmap due to union overlap.
--

commit 5d26a4aca1dc2966f5003f268c0a69349efe5210
Author: Wei Fang <wei.fang@nxp.com>

net: enetc: move mac_filter from struct enetc_pf to struct enetc_si

The mac_filter array currently resides in struct enetc_pf and is used to
track unicast and multicast MAC address filters for the PF. Since struct
enetc_si is the common structure shared between the PF and VF drivers,
move mac_filter into struct enetc_si to prepare for MAC filter support
in the VF driver.

> diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
> index c467dc05510ef..523c713247805 100644
> --- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c
> +++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
[ ... ]
> @@ -60,10 +60,9 @@ static void enetc_add_mac_addr_em_filter(struct enetc_mac_filter *filter,
>  	filter->mac_addr_cnt++;
>  }
>  
> -static void enetc_sync_mac_filters(struct enetc_pf *pf)
> +static void enetc_sync_mac_filters(struct enetc_si *si)
>  {

[Severity: High]
This is a pre-existing issue, but since this patch refactors the mac_filter
storage, does the fallback path in enetc_sync_mac_filters() incorrectly read
corrupted hash data due to a union overlap?

Because mac_addr and mac_hash_table share a union in struct enetc_mac_filter:

struct enetc_mac_filter {
    union {
        char mac_addr[ETH_ALEN];
        DECLARE_BITMAP(mac_hash_table, ENETC_MADDR_HASH_TBL_SZ);
    };
    int mac_addr_cnt;
};

When there is exactly one unicast MAC address and the exact-match insertion
fails (e.g., due to a hardware timeout), the driver falls back to hash table
filtering. Because of the union overlap, it appears the fallback path will
read the raw MAC address bytes as a 64-bit hash table mask:

    /* exact match filter */
    if (em) {
        ...
        err = enetc_set_mac_flt_entry(si, pos, f->mac_addr, BIT(0));
        if (!err)
            continue;

        /* fallback to HT filtering */
        dev_warn(&si->pdev->dev, "fallback to HT filt (%d)\n", err);
    }

    bitmap_to_arr64(&hash, f->mac_hash_table, ENETC_MADDR_HASH_TBL_SZ);
    /* hash table filter, clear EM filter for UC entries */

Could this cause the device to drop valid packets or receive invalid ones by
programming the MAC address bytes as the hash bitmap?

> -	struct enetc_mac_filter *f = pf->mac_filter;
> -	struct enetc_si *si = pf->si;
> +	struct enetc_mac_filter *f = si->mac_filter;
>  	int i, pos;
>  
>  	pos = EMETC_MAC_ADDR_FILT_RES;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260909100733.1139689-1-wei.fang@oss.nxp.com?part=8