[PATCH v3 net 0/9] net: enetc: SR-IOV robustness and security fixes

[Wei Fang <wei.fang@nxp.com>]

This patch series addresses a number of robustness, security, and
correctness issues in the ENETC driver's SR-IOV subsystem, focusing
primarily on the VF-to-PF mailbox communication path.

The series can be grouped into the following categories:

1. DoS and security fixes:
   - Prevent an unbounded loop DoS in the VF-to-PF message handler,
     which could be triggered by a malicious or misbehaving VF.
   - Fix a TOCTOU (Time-of-Check-Time-of-Use) race and add proper
     validation of VF MAC addresses to prevent spoofing or invalid
     configuration from being applied.

2. Race condition fixes:
   - Fix a race condition in VF MAC address configuration that could
     lead to inconsistent state between the VF request and PF
     application.
   - Fix a race condition during SR-IOV teardown that could cause
     VF->PF mailbox operations to time out, resulting in unnecessary
     errors during shutdown.

3. Memory safety fixes:
   - Fix a DMA write to freed memory in enetc_msg_free_mbx(), which
     could cause silent memory corruption or system instability.

4. Error handling and initialization fixes:
   - Fix missing error code propagation when pf->vf_state allocation
     fails, ensuring callers receive a proper errno instead of
     succeeding silently.
   - Fix incorrect mailbox message status values returned to VFs,
     which could cause VFs to misinterpret PF responses.
   - Fix initialization order to prevent the use of uninitialized
     resources during driver probe, which could cause undefined
     behavior on certain configurations.

5. Diagnostics improvement:
   - Add rate limiting to VF mailbox error messages to prevent log
     flooding in the presence of a misbehaving VF.

These fixes improve the overall stability and security of the ENETC
SR-IOV implementation, particularly in multi-tenant environments where
VFs may be assigned to untrusted guests.

---
v3:
1. Improve the implementation of patch 7, such as add new macros
   ENETC_PSIMR_MASK and ENETC_PSIMR_BIT, ENETC_PSIIER is enabled based
   on the number of active VSIs, mr_status is derived from ENETC_PSIIDR
   and ENETC_PSIMSGRR and so on. Also update the subject and commit
   message.
2. Update the commit message of patch 8, add description of the change
   in enetc_msg_psi_free().
3. Collect the Reviewed-by tags.
v2 link: https://lore.kernel.org/imx/20260518030535.1057228-1-wei.fang@nxp.com/
v2:
1. Copy the message content from DMA memory to local memory
2. Patch 3 and 5 in v1 are merged into patch 8 in v2
3. Add more fix patches, such as patch 1, 2, 6 and 7
v1 link: https://lore.kernel.org/imx/20260513103021.2190593-1-wei.fang@nxp.com/
---

Wei Fang (9):
  net: enetc: fix incorrect mailbox message status returned to VFs
  net: enetc: fix missing error code when pf->vf_state allocation fails
  net: enetc: add ratelimiting to VF mailbox error messages
  net: enetc: fix TOCTOU race and validate VF MAC address
  net: enetc: fix race condition in VF MAC address configuration
  net: enetc: fix DMA write to freed memory in enetc_msg_free_mbx()
  net: enetc: fix unbounded loop and interrupt handling in VF-to-PF
    messaging
  net: enetc: fix init and teardown order to prevent use of unsafe
    resources
  net: enetc: avoid VF->PF mailbox timeout during SR-IOV teardown

 .../net/ethernet/freescale/enetc/enetc_hw.h   |  15 ++-
 .../net/ethernet/freescale/enetc/enetc_msg.c  | 106 ++++++++++--------
 .../net/ethernet/freescale/enetc/enetc_pf.c   |  75 +++++++++----
 .../net/ethernet/freescale/enetc/enetc_pf.h   |   1 +
 4 files changed, 127 insertions(+), 70 deletions(-)

-- 
2.34.1