net: mana: Fix mana_destroy_rxq() cleanup for partial RXQ init
Status from this message: This series was applied to netdev/net.git (main)
Get series with b4
b4 am [email protected]Versions newest first
Patches in v1 All 3 applied
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/3 | net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq()drivers/ | +3 | 0 replies | Applied |
| 2/3 | net: mana: Skip WQ object destruction for uninitialized RXQdrivers/ | +2 | 0 replies | Applied |
| 3/3 | net: mana: remove double CQ cleanup in mana_create_rxq error pathdrivers/ | +0 | 1 reply | Applied |
Reviews trailers per patch
All 3 patches have a Reviewed-by or Acked-by of their own; the series has one for all of them.
| Patch | Haiyang Zhang | Aditya Garg | Simon Horman |
|---|---|---|---|
| Series | R-b | ||
| 1/3 | R-b | ||
| 2/3 | R-b | ||
| 3/3 | R-b | R-b |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 3 reviewers.
Cover letter [PATCH 0/3] net: mana: Fix mana_destroy_rxq() cleanup for partial RXQ init
When mana_create_rxq() fails partway through initialization (e.g. the hardware rejects the WQ object creation), the error path calls mana_destroy_rxq() to tear down a partially-initialized RXQ. This exposed multiple issues in mana_destroy_rxq() path, as it assumed the RXQ was always fully initialized, leading to multiple issues:
1. xdp_rxq_info_unreg() was called on an unregistered xdp_rxq, triggering a WARN_ON ("Driver BUG") in net/core/xdp.c.
2. mana_destroy_wq_obj() was called with INVALID_MANA_HANDLE, sending a bogus destroy command to the hardware.
3. mana_deinit_cq() was called twice — once inside mana_destroy_rxq() and again in mana_create_rxq()'s error path — causing a use-after-free since mana_destroy_rxq() frees the rxq first.
This was observed during ethtool ring parameter changes when the hardware returned an error creating the RXQ. This series makes mana_destroy_rxq() safe to call at any stage of RXQ initialization by guarding each teardown step, and removes the redundant cleanup in mana_create_rxq().
Dipayaan Roy (3):
net: mana: check xdp_rxq registration before unreg in
mana_destroy_rxq()
net: mana: Skip WQ object destruction for uninitialized RXQ
net: mana: remove double CQ cleanup in mana_create_rxq error path
drivers/net/ethernet/microsoft/mana/mana_en.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
Signature · 1 line
2.43.0