Re: [PATCH net-next v13 2/2] net: mana: force full-page RX buffers via ethtool private flag

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-after-free of BPF program when mana_pre_alloc_rxbufs fails during XDP setup
--

--- Patch [2]: [PATCH net-next v13 2/2] net: mana: force full-page RX buffers via ethtool private flag ---
commit 2ea505589c71d255969461add82f06436f8f8e80
Author: Dipayaan Roy <dipayanroy@linux.microsoft.com>

net: mana: force full-page RX buffers via ethtool private flag

This commit adds an ethtool private flag to force one RX buffer per page,
bypassing the page_pool fragment path. This is intended to restore
line-rate throughput on certain ARM64 platforms with 4K PAGE_SIZE.

> diff --git a/drivers/net/ethernet/microsoft/mana/mana_ethtool.c b/drivers/net/ethernet/microsoft/mana/mana_ethtool.c
> index 482cd16009abb..7e441d6ae5dce 100644
> --- a/drivers/net/ethernet/microsoft/mana/mana_ethtool.c
> +++ b/drivers/net/ethernet/microsoft/mana/mana_ethtool.c
[ ... ]
> @@ -756,6 +775,78 @@ static int mana_get_link_ksettings(struct net_device *ndev,
[ ... ]
> +static int mana_set_priv_flags(struct net_device *ndev, u32 priv_flags)
> +{
[ ... ]
> +	if (changed & BIT(MANA_PRIV_FLAG_USE_FULL_PAGE_RXBUF)) {
[ ... ]
> +		err = mana_pre_alloc_rxbufs(apc, ndev->mtu, apc->num_queues);
> +		if (err) {
> +			netdev_err(ndev,
> +				   "Insufficient memory for new allocations\n");
> +			apc->priv_flags = old_priv_flags;
> +			goto clear_flag;
> +		}

[Severity: High]
This isn't a bug introduced by this patch, but while reviewing the callers
of mana_pre_alloc_rxbufs(), does a failure during XDP setup leave a dangling
pointer?

In drivers/net/ethernet/microsoft/mana/mana_bpf.c:mana_xdp_set(),
apc->bpf_prog is updated before the allocation:

        apc->bpf_prog = prog;

If the allocation fails, the function returns early without cleaning up:

        err = mana_pre_alloc_rxbufs(apc, ndev->mtu, apc->num_queues);
        if (err) {
                NL_SET_ERR_MSG_MOD(extack,
                                   "XDP: Insufficient memory ...");
                return err;
        }

The core network stack handles the error by releasing its reference to the
new BPF program, which may then be freed. Because the early return skips
the err_dealloc_rxbuffs label, apc->bpf_prog is never reverted to old_prog.
Could a subsequent interface flap execute mana_attach() and assign this
freed BPF program to the hardware RX queues, causing a use-after-free?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260729063347.3388035-1-dipayanroy@linux.microsoft.com?part=2