Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] net: mana: out-of-bounds read on unvalidated hardware msg_id --
commit 9775f43816d83151fa521309768c62ad04b477da Author: Long Li <[email protected]> net: mana: support concurrent HWC requests This commit replaces the depth-one timeout latch with per-slot sender and response ownership. It synchronizes timeout updates, implements runtime teardown logic, and splits HWC request paths into structured helpers to support concurrent hardware channel requests. Link: https://lore.kernel.org/r/[email protected] Link: https://lore.kernel.org/r/[email protected] > diff --git a/drivers/net/ethernet/microsoft/mana/hw_channel.c > b/drivers/net/ethernet/microsoft/mana/hw_channel.c > index 89b6e30863dae..9fdd84ccba653 100644 > --- a/drivers/net/ethernet/microsoft/mana/hw_channel.c > +++ b/drivers/net/ethernet/microsoft/mana/hw_channel.c [ ... ] > @@ -97,40 +162,54 @@ static void mana_hwc_handle_resp(struct > hw_channel_context *hwc, u32 resp_len, > struct hwc_work_request *rx_req, u16 msg_id) > { > const struct gdma_resp_hdr *resp_msg = rx_req->buf_va; > + struct gdma_resource *r = &hwc->inflight_msg_res; > struct hwc_caller_ctx *ctx; > + bool release; > int err; > > - if (!test_bit(msg_id, hwc->inflight_msg_res.map)) { > + spin_lock(&r->lock); > + if (!test_bit(msg_id, r->map)) { > + spin_unlock(&r->lock); > dev_err(hwc->dev, "hwc_rx: invalid msg_id = %u\n", msg_id); > mana_hwc_post_rx_wqe(hwc->rxq, rx_req); > return; > } > > ctx = hwc->caller_ctx + msg_id; [Severity: High] Can this result in an out-of-bounds memory access if the hardware returns an invalid msg_id? The msg_id value originates from the hardware completion structure. In mana_hwc_handle_resp(), it is used directly in test_bit(msg_id, r->map) and as an array offset for hwc->caller_ctx without any bounds verification. If the hardware provides a malformed msg_id (e.g., larger than r->size), test_bit() will perform an out-of-bounds read, and the array indexing will result in out-of-bounds pointer arithmetic. This can subsequently lead to memory corruption when the code acquires ctx->lock and copies data into ctx->output_buf. Should there be a bounds check against r->size or hwc->num_inflight_msg before msg_id is used here? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=3
