Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Uncancelled background works (`mana_serv_work` and `mana_dev_recovery_work`) lead to Use-After-Free of `gdma_context` during device removal. -- --- Patch [1]: [PATCH net-next v4] net: mana: Add handler for sriov configure --- commit d651d90ceb3e1716b100c2eb4035662f066b67fa Author: Haiyang Zhang <[email protected]> net: mana: Add handler for sriov configure This commit adds a callback function for the pci_driver / sriov_configure interface. It requests the NIC to provide a specific number of VFs, or disables VFs if the requested number is zero. > diff --git a/drivers/net/ethernet/microsoft/mana/gdma_main.c > b/drivers/net/ethernet/microsoft/mana/gdma_main.c > index aef3b77229c13..a38d4bb74621f 100644 > --- a/drivers/net/ethernet/microsoft/mana/gdma_main.c > +++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c > @@ -2456,6 +2456,8 @@ static void mana_gd_remove(struct pci_dev *pdev) > { > struct gdma_context *gc = pci_get_drvdata(pdev); > > + pci_disable_sriov(pdev); > + > mana_rdma_remove(&gc->mana_ib); > mana_remove(&gc->mana, false); [Severity: High] This is a pre-existing issue, but can this lead to a Use-After-Free of gdma_context if there are uncancelled background works? When mana_gd_remove() executes, it eventually frees the gdma_context via vfree(gc) without flushing works like mana_serv_work or mana_dev_recovery_work that might be pending on the system_wq. If a hardware event triggers mana_gd_process_eqe() and schedules serv_work before a hot-unplug, could the scheduled work run after mana_gd_remove() has freed the context? The worker thread mana_serv_func() calls mana_serv_reset(), which does: struct gdma_context *gc = pci_get_drvdata(pdev); ... hwc = gc->hwc.driver_data; Since the PCI core only clears drvdata after remove() returns, this could dereference the freed gc memory. Should these background works be cancelled before freeing the context? [ ... ] -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
