Re: [PATCH 0/3] net: mana: Fix mana_destroy_rxq() cleanup for partial RXQ init
Hello:
This series was applied to netdev/net.git (main)
by Paolo Abeni :
On Wed, 29 Apr 2026 20:57:51 -0700 you wrote:
> When mana_create_rxq() fails partway through initialization (e.g. the
> hardware rejects the WQ object creation), the error path calls
> mana_destroy_rxq() to tear down a partially-initialized RXQ.
> This exposed multiple issues in mana_destroy_rxq() path, as it assumed
> the RXQ was always fully initialized, leading to multiple issues:
>
> 1. xdp_rxq_info_unreg() was called on an unregistered xdp_rxq,
>triggering a WARN_ON ("Driver BUG") in net/core/xdp.c.
>
> [...]
Here is the summary with links:
- [1/3] net: mana: check xdp_rxq registration before unreg in
mana_destroy_rxq()
https://git.kernel.org/netdev/net/c/e9e334f8063a
- [2/3] net: mana: Skip WQ object destruction for uninitialized RXQ
https://git.kernel.org/netdev/net/c/2a1c69118282
- [3/3] net: mana: remove double CQ cleanup in mana_create_rxq error path
https://git.kernel.org/netdev/net/c/3985c9a56da4
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
Re: [PATCH 0/3] net: mana: Fix mana_destroy_rxq() cleanup for partial RXQ init
On Sat, May 02, 2026 at 05:52:58PM +0100, Simon Horman wrote:
> On Wed, Apr 29, 2026 at 08:57:51PM -0700, Dipayaan Roy wrote:
> > When mana_create_rxq() fails partway through initialization (e.g. the
> > hardware rejects the WQ object creation), the error path calls
> > mana_destroy_rxq() to tear down a partially-initialized RXQ.
> > This exposed multiple issues in mana_destroy_rxq() path, as it assumed
> > the RXQ was always fully initialized, leading to multiple issues:
> >
> > 1. xdp_rxq_info_unreg() was called on an unregistered xdp_rxq,
> >triggering a WARN_ON ("Driver BUG") in net/core/xdp.c.
> >
> > 2. mana_destroy_wq_obj() was called with INVALID_MANA_HANDLE,
> >sending a bogus destroy command to the hardware.
> >
> > 3. mana_deinit_cq() was called twice — once inside mana_destroy_rxq()
> >and again in mana_create_rxq()'s error path — causing a
> >use-after-free since mana_destroy_rxq() frees the rxq first.
> >
> > This was observed during ethtool ring parameter changes when the
> > hardware returned an error creating the RXQ. This series makes
> > mana_destroy_rxq() safe to call at any stage of RXQ initialization
> > by guarding each teardown step, and removes the redundant cleanup
> > in mana_create_rxq().
>
> For the series:
>
> Reviewed-by: Simon Horman
>
> I don't think that you need to repost for this. But please keep in mind for
> future submissions that fixes for code present in the net tree should be
> targeted at that tree, like this:
>
> Subject: [PATCH net vN/M] ...
Thanks Simon,
it was a typo from my end.
>
> Also, FTR, there is an AI generated review of this patch-set available
> on sashiko.dev. It seems to me that the issues flagged there pre-date
> this patch-set and should not block progress of it. But you may wish
> to use that review as the basis of some follow-up.
Agreed, Sashiko flagged a pre-exisitng issue in the tx path.
I will send that as a separate patch set.
Thanks and Regards
Dipayaan Roy
Re: [PATCH 0/3] net: mana: Fix mana_destroy_rxq() cleanup for partial RXQ init
On Wed, Apr 29, 2026 at 08:57:51PM -0700, Dipayaan Roy wrote:
> When mana_create_rxq() fails partway through initialization (e.g. the
> hardware rejects the WQ object creation), the error path calls
> mana_destroy_rxq() to tear down a partially-initialized RXQ.
> This exposed multiple issues in mana_destroy_rxq() path, as it assumed
> the RXQ was always fully initialized, leading to multiple issues:
>
> 1. xdp_rxq_info_unreg() was called on an unregistered xdp_rxq,
>triggering a WARN_ON ("Driver BUG") in net/core/xdp.c.
>
> 2. mana_destroy_wq_obj() was called with INVALID_MANA_HANDLE,
>sending a bogus destroy command to the hardware.
>
> 3. mana_deinit_cq() was called twice — once inside mana_destroy_rxq()
>and again in mana_create_rxq()'s error path — causing a
>use-after-free since mana_destroy_rxq() frees the rxq first.
>
> This was observed during ethtool ring parameter changes when the
> hardware returned an error creating the RXQ. This series makes
> mana_destroy_rxq() safe to call at any stage of RXQ initialization
> by guarding each teardown step, and removes the redundant cleanup
> in mana_create_rxq().
For the series:
Reviewed-by: Simon Horman
I don't think that you need to repost for this. But please keep in mind for
future submissions that fixes for code present in the net tree should be
targeted at that tree, like this:
Subject: [PATCH net vN/M] ...
Also, FTR, there is an AI generated review of this patch-set available
on sashiko.dev. It seems to me that the issues flagged there pre-date
this patch-set and should not block progress of it. But you may wish
to use that review as the basis of some follow-up.
