Re: [PATCH net-next v8 1/6] net: mana: Create separate EQs for each vPort

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [Critical] Missing reference counting for EQs in RSS QP leads to Use-After-Free and DMA corruption.
- [High] An off-by-one error in the `mana_ib_create_qp_rss` error handling path causes a memory leak of previously allocated WQ objects.
- [High] Lockless access to `mpc->eqs` causes TOCTOU races resulting in NULL pointer dereferences or Use-After-Free.
--

commit e7e0da70dd7f308d1d04d77e17767cbeb27d8fb9
Author: Long Li <longli@microsoft.com>

net: mana: Create separate EQs for each vPort

To prepare for assigning vPorts to dedicated MSI-X vectors, remove EQ
sharing among the vPorts and create dedicated EQs for each vPort.

> diff --git a/drivers/infiniband/hw/mana/qp.c b/drivers/infiniband/hw/mana/qp.c
> index 0fbcf449c134b..6167742df9d29 100644
> --- a/drivers/infiniband/hw/mana/qp.c
> +++ b/drivers/infiniband/hw/mana/qp.c
> @@ -171,7 +171,15 @@ static int mana_ib_create_qp_rss(struct ib_qp *ibqp, struct ib_pd *pd,
>  		cq_spec.gdma_region = cq->queue.gdma_region;
>  		cq_spec.queue_size = cq->cqe * COMP_ENTRY_SIZE;
>  		cq_spec.modr_ctx_id = 0;
> -		eq = &mpc->ac->eqs[cq->comp_vector];
> +		/* EQs are created when a raw QP configures the vport.
> +		 * A raw QP must be created before creating rwq_ind_tbl.
> +		 */
> +		if (!mpc->eqs) {
> +			ret = -EINVAL;
> +			i--;

Does this double decrement leak the WQ object?

If the failure occurs at index i=1, the explicit i-- makes it 0. The
while (i-- > 0) in the fail: block then evaluates to 0-- > 0 (false), skipping
the cleanup of index 0 and leaking the WQ resource from the previous
iteration.

> +			goto fail;
> +		}

Does this access to mpc->eqs need synchronization?

If this races with mana_create_eq(), mana_create_eq() publishes the apc->eqs
array via kzalloc_objs() before actually initializing the inner queue pointers
(apc->eqs[i].eq) in a subsequent loop. The RDMA thread could observe
mpc->eqs != NULL, read a NULL eq->eq pointer, and panic when dereferencing
eq->eq->id.

Similarly, could a race with mana_destroy_eq() lead to a use-after-free on
the mpc->eqs array?

> +		eq = &mpc->eqs[cq->comp_vector % mpc->num_queues];
>  		cq_spec.attached_eq = eq->eq->id;

Does this code need to hold a reference to the vport?

This binds the Completion Queue to the port's Event Queues, but it does not
appear to increment pd->vport_use_count or otherwise hold a reference to
the EQs.

If the EQs were created by a raw QP and that raw QP is destroyed,
pd->vport_use_count drops to 0, which triggers mana_destroy_eq(). The EQs
can also be destroyed unconditionally by the Ethernet driver if the interface
is brought down.

Could the DMA memory and the mpc->eqs array be freed while the RSS QP remains
active, leading to a use-after-free and DMA corruption when hardware events
occur?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260508221202.15725-1-longli@microsoft.com?part=1