Re: [PATCH net-next v4] net: mana: Add handler for sriov configure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Uncancelled background works (`mana_serv_work` and `mana_dev_recovery_work`) lead to Use-After-Free of `gdma_context` during device removal.
--

--- Patch [1]: [PATCH net-next v4] net: mana: Add handler for sriov configure ---
commit d651d90ceb3e1716b100c2eb4035662f066b67fa
Author: Haiyang Zhang <haiyangz@microsoft.com>

net: mana: Add handler for sriov configure

This commit adds a callback function for the pci_driver / sriov_configure
interface. It requests the NIC to provide a specific number of VFs, or
disables VFs if the requested number is zero.

> diff --git a/drivers/net/ethernet/microsoft/mana/gdma_main.c b/drivers/net/ethernet/microsoft/mana/gdma_main.c
> index aef3b77229c13..a38d4bb74621f 100644
> --- a/drivers/net/ethernet/microsoft/mana/gdma_main.c
> +++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c
> @@ -2456,6 +2456,8 @@ static void mana_gd_remove(struct pci_dev *pdev)
>  {
>  	struct gdma_context *gc = pci_get_drvdata(pdev);
>  
> +	pci_disable_sriov(pdev);
> +
>  	mana_rdma_remove(&gc->mana_ib);
>  	mana_remove(&gc->mana, false);

[Severity: High]
This is a pre-existing issue, but can this lead to a Use-After-Free of
gdma_context if there are uncancelled background works?

When mana_gd_remove() executes, it eventually frees the gdma_context via
vfree(gc) without flushing works like mana_serv_work or
mana_dev_recovery_work that might be pending on the system_wq.

If a hardware event triggers mana_gd_process_eqe() and schedules
serv_work before a hot-unplug, could the scheduled work run after
mana_gd_remove() has freed the context?

The worker thread mana_serv_func() calls mana_serv_reset(), which does:

    struct gdma_context *gc = pci_get_drvdata(pdev);
    ...
    hwc = gc->hwc.driver_data;

Since the PCI core only clears drvdata after remove() returns, this could
dereference the freed gc memory. Should these background works be
cancelled before freeing the context?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260710192735.2921300-1-haiyangz@linux.microsoft.com?part=1