Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Preexisting use-after-free of `hwc_cq->comp_buf` during HWC CQ destruction due to a race with the interrupt handler. -- commit a87caaea6f635bdcf7c331ad2a7a65f2ff025635 Author: Long Li <[email protected]> Subject: net: mana: support concurrent HWC requests This commit serializes SQ posting and protects HWC lookup and sender accounting with hwc_lock. Teardown now stops admission, force-completes requests, and drains senders before destroying the CQ, TXQ, and RXQ. > diff --git a/drivers/net/ethernet/microsoft/mana/hw_channel.c > b/drivers/net/ethernet/microsoft/mana/hw_channel.c > index 6605e7a9c481b..a4f7346d285f7 100644 > --- a/drivers/net/ethernet/microsoft/mana/hw_channel.c > +++ b/drivers/net/ethernet/microsoft/mana/hw_channel.c [ ... ] > @@ -864,14 +974,28 @@ void mana_hwc_destroy_channel(struct gdma_context *gc) > } > gc->max_num_cqs = 0; > > + /* Deregister the HWC EQ before freeing the work queues. */ > + if (hwc->cq) > + mana_hwc_destroy_cq(hwc->gdma_dev->gdma_context, hwc->cq); > + [Severity: High] This is a pre-existing issue, but since this patch moves the call to mana_hwc_destroy_cq(), is it worth fixing a use-after-free bug in that function's teardown path? In mana_hwc_destroy_cq(), hwc_cq->comp_buf is freed before the EQ is destroyed: mana_hwc_destroy_cq() { kfree(hwc_cq->comp_buf); if (hwc_cq->gdma_cq) mana_gd_destroy_queue(gc, hwc_cq->gdma_cq); if (hwc_cq->gdma_eq) mana_gd_destroy_queue(gc, hwc_cq->gdma_eq); ... } Because mana_gd_destroy_queue() on the EQ is what performs synchronize_rcu() to wait for concurrent interrupt handlers to finish, a racing interrupt handler on another CPU could still execute mana_hwc_comp_event() after the buffer is freed: mana_hwc_comp_event() { ... completions = hwc_cq->comp_buf; comp_read = mana_gd_poll_cq(q_self, completions, hwc_cq->queue_depth); ... } Could this lead to a use-after-free and memory corruption when mana_gd_poll_cq() writes hardware completion events into the freed completions buffer? > if (hwc->txq) > mana_hwc_destroy_wq(hwc, hwc->txq); [ ... ] -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=3
