[PATCH v2 net 0/9] net: enetc: SR-IOV robustness and security fixes

[Wei Fang <wei.fang@nxp.com>]

This patch series addresses a number of robustness, security, and
correctness issues in the ENETC driver's SR-IOV subsystem, focusing
primarily on the VF-to-PF mailbox communication path.

The series can be grouped into the following categories:

1. DoS and security fixes:
   - Prevent an unbounded loop DoS in the VF-to-PF message handler,
     which could be triggered by a malicious or misbehaving VF.
   - Fix a TOCTOU (Time-of-Check-Time-of-Use) race and add proper
     validation of VF MAC addresses to prevent spoofing or invalid
     configuration from being applied.

2. Race condition fixes:
   - Fix a race condition in VF MAC address configuration that could
     lead to inconsistent state between the VF request and PF
     application.
   - Fix a race condition during SR-IOV teardown that could cause
     VF->PF mailbox operations to time out, resulting in unnecessary
     errors during shutdown.

3. Memory safety fixes:
   - Fix a DMA write to freed memory in enetc_msg_free_mbx(), which
     could cause silent memory corruption or system instability.

4. Error handling and initialization fixes:
   - Fix missing error code propagation when pf->vf_state allocation
     fails, ensuring callers receive a proper errno instead of
     succeeding silently.
   - Fix incorrect mailbox message status values returned to VFs,
     which could cause VFs to misinterpret PF responses.
   - Fix initialization order to prevent the use of uninitialized
     resources during driver probe, which could cause undefined
     behavior on certain configurations.

5. Diagnostics improvement:
   - Add rate limiting to VF mailbox error messages to prevent log
     flooding in the presence of a misbehaving VF.

These fixes improve the overall stability and security of the ENETC
SR-IOV implementation, particularly in multi-tenant environments where
VFs may be assigned to untrusted guests.

---
v2:
1. Copy the message content from DMA memory to local memory
2. Patch 3 and 5 in v1 are merged into patch 8 in v2
3. Add more fix patches, such as patch 1, 2, 6 and 7
v1 link: https://lore.kernel.org/imx/20260513103021.2190593-1-wei.fang@nxp.com/
---

Wei Fang (9):
  net: enetc: fix incorrect mailbox message status returned to VFs
  net: enetc: fix missing error code when pf->vf_state allocation fails
  net: enetc: add ratelimiting to VF mailbox error messages
  net: enetc: fix TOCTOU race and validate VF MAC address
  net: enetc: fix race condition in VF MAC address configuration
  net: enetc: fix DMA write to freed memory in enetc_msg_free_mbx()
  net: enetc: fix VF-to-PF message handler unbounded loop DoS
  net: enetc: fix initialization order to prevent use of uninitialized
    resources
  net: enetc: avoid VF->PF mailbox timeout during SR-IOV teardown

 .../net/ethernet/freescale/enetc/enetc_hw.h   |  1 +
 .../net/ethernet/freescale/enetc/enetc_msg.c  | 79 ++++++++++---------
 .../net/ethernet/freescale/enetc/enetc_pf.c   | 75 +++++++++++++-----
 .../net/ethernet/freescale/enetc/enetc_pf.h   |  1 +
 4 files changed, 98 insertions(+), 58 deletions(-)

-- 
2.34.1