Re: [PATCH net-next v4 11/13] net: mana: keep a user-configured RSS table across a queue rebuild
From: sashiko-bot@kernel.org
Date: 2026-09-09 03:29:49
Also in:
linux-rdma
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider: New issues: - [High] Silent replacement of an invalid RSS table in `mana_alloc_queues` without notifying the ethtool core causes the table to be falsely treated as user-configured, permanently breaking default table auto-scaling. Pre-existing issues: - [High] Heap out-of-bounds read and write due to untrusted hardware configuration changing across resets. -- commit 935252e88b1186422d52dcb7eb47455372ea3ed9 Author: Long Li [off-list ref] Subject: net: mana: keep a user-configured RSS table across a queue rebuild Preserve a user RSS table whenever all entries fit the requested queue count. Regenerate driver defaults. On growth, a retained user table does not steer RSS traffic to the added queues until the user updates it.
quoted hunk ↗ jump to hunk
diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c index fc96837d69a00..78be88b29c99b 100644 --- a/drivers/net/ethernet/microsoft/mana/mana_en.c +++ b/drivers/net/ethernet/microsoft/mana/mana_en.c@@ -3548,6 +3548,27 @@ static void mana_rss_table_init(struct mana_port_context *apc) ethtool_rxfh_indir_default(i, apc->num_queues); } +/* Keep user tables with valid indices; defer loss notification. */ +static bool mana_rss_table_keep(struct mana_port_context *apc, + unsigned int num_queues, bool *lost) +{ + u32 i; + + *lost = false; + + if (!netif_is_rxfh_configured(apc->ndev)) + return false; + + for (i = 0; i < apc->indir_table_sz; i++) { + if (apc->indir_table[i] >= num_queues) {
[Severity: High] This is a pre-existing issue, but can this out-of-bounds read occur if the hardware configuration changes across resets? If the hardware/firmware returns a larger num_indirection_ent during a device reset (e.g., timeout recovery triggering mana_attach()), mana_init_port() updates apc->indir_table_sz via mana_query_vport_cfg(). However, mana_attach() fails to reallocate apc->indir_table to accommodate this potentially new size. When mana_alloc_queues() is subsequently called, mana_rss_table_keep() and mana_rss_table_init() iterate up to the new, larger apc->indir_table_sz, causing an out-of-bounds read and write on the statically allocated buffer.
+ *lost = true; + return false; + } + } + + return true; +} +
[ ... ]
quoted hunk ↗ jump to hunk
@@ -3863,7 +3885,9 @@ int mana_alloc_queues(struct net_device *ndev) goto destroy_rxq; } - mana_rss_table_init(apc); + /* Loss notification needs a netdev instance lock we may lack. */ + if (!mana_rss_table_keep(apc, apc->num_queues, &indir_lost)) + mana_rss_table_init(apc);
[Severity: High] Does this silent replacement of an invalid RSS table without notifying the ethtool core permanently break default table auto-scaling? If a user configures a custom RSS table, lowers the queue count while the port is down, brings the port up, and then increases the queue count while the port is up, the newly added queues might permanently receive no RSS traffic. Because the driver silently replaces the invalid custom table with a smaller default table during the down/up cycle but fails to notify the ethtool core (by intentionally omitting a call to ethtool_rxfh_indir_lost()), the core remains desynchronized. Later, when the queue count is increased, mana_grow_qset() falsely assumes the small default table is the user's custom table and preserves it, failing to scale the RSS indirection table to include the new queues. -- Sashiko AI review · https://sashiko.dev/#/patchset/20260908032843.397667-1-longli@microsoft.com?part=11