Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Use-after-free of BPF program when mana_pre_alloc_rxbufs fails during XDP setup -- --- Patch [2]: [PATCH net-next v13 2/2] net: mana: force full-page RX buffers via ethtool private flag --- commit 2ea505589c71d255969461add82f06436f8f8e80 Author: Dipayaan Roy <[email protected]> net: mana: force full-page RX buffers via ethtool private flag This commit adds an ethtool private flag to force one RX buffer per page, bypassing the page_pool fragment path. This is intended to restore line-rate throughput on certain ARM64 platforms with 4K PAGE_SIZE. > diff --git a/drivers/net/ethernet/microsoft/mana/mana_ethtool.c > b/drivers/net/ethernet/microsoft/mana/mana_ethtool.c > index 482cd16009abb..7e441d6ae5dce 100644 > --- a/drivers/net/ethernet/microsoft/mana/mana_ethtool.c > +++ b/drivers/net/ethernet/microsoft/mana/mana_ethtool.c [ ... ] > @@ -756,6 +775,78 @@ static int mana_get_link_ksettings(struct net_device > *ndev, [ ... ] > +static int mana_set_priv_flags(struct net_device *ndev, u32 priv_flags) > +{ [ ... ] > + if (changed & BIT(MANA_PRIV_FLAG_USE_FULL_PAGE_RXBUF)) { [ ... ] > + err = mana_pre_alloc_rxbufs(apc, ndev->mtu, apc->num_queues); > + if (err) { > + netdev_err(ndev, > + "Insufficient memory for new allocations\n"); > + apc->priv_flags = old_priv_flags; > + goto clear_flag; > + } [Severity: High] This isn't a bug introduced by this patch, but while reviewing the callers of mana_pre_alloc_rxbufs(), does a failure during XDP setup leave a dangling pointer? In drivers/net/ethernet/microsoft/mana/mana_bpf.c:mana_xdp_set(), apc->bpf_prog is updated before the allocation: apc->bpf_prog = prog; If the allocation fails, the function returns early without cleaning up: err = mana_pre_alloc_rxbufs(apc, ndev->mtu, apc->num_queues); if (err) { NL_SET_ERR_MSG_MOD(extack, "XDP: Insufficient memory ..."); return err; } The core network stack handles the error by releasing its reference to the new BPF program, which may then be freed. Because the early return skips the err_dealloc_rxbuffs label, apc->bpf_prog is never reverted to old_prog. Could a subsequent interface flap execute mana_attach() and assign this freed BPF program to the hardware RX queues, causing a use-after-free? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=2
