[PATCH net v3 2/6] net: mana: fix HWC RQ/SQ buffer size swap
From: Long Li <longli@microsoft.com>
Date: 2026-08-03 23:44:23
Also in:
linux-hyperv, linux-rdma, lkml
Subsystem:
hyper-v/azure core and drivers, networking drivers, networking [general], the rest · Maintainers:
"K. Y. Srinivasan", Haiyang Zhang, Wei Liu, Dexuan Cui, Long Li, Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
The HWC RQ receives responses and the SQ sends requests, but
mana_hwc_init_queues() sized the RQ with max_req_msg_size and the SQ with
max_resp_msg_size -- backwards. A response larger than the undersized RQ
buffer could overflow it, and mana_hwc_rx_event_handler() recovered the
RX slot index by dividing by the wrong size (max_req_msg_size).
Size the RQ by max_resp_msg_size and the SQ by max_req_msg_size, store
max_resp_msg_size in hw_channel_context, and use it as the RX slot
stride.
Store the queue dimensions before creating the CQ, which registers the
RX completion handler: that handler divides by max_resp_msg_size and
range-checks num_inflight_msg, so both must be set before it can run.
Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)")
Signed-off-by: Long Li <longli@microsoft.com>
---
.../net/ethernet/microsoft/mana/hw_channel.c | 18 ++++++++++++------
include/net/mana/hw_channel.h | 1 +
2 files changed, 13 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/microsoft/mana/hw_channel.c b/drivers/net/ethernet/microsoft/mana/hw_channel.c
index 409e20caeccd..cbb56c764787 100644
--- a/drivers/net/ethernet/microsoft/mana/hw_channel.c
+++ b/drivers/net/ethernet/microsoft/mana/hw_channel.c@@ -263,7 +263,7 @@ static void mana_hwc_rx_event_handler(void *ctx, u32 gdma_rxq_id, /* Select the RX work request for virtual address and for reposting. */ rq_base_addr = hwc_rxq->msg_buf->mem_info.dma_handle; - rx_req_idx = (sge->address - rq_base_addr) / hwc->max_req_msg_size; + rx_req_idx = (sge->address - rq_base_addr) / hwc->max_resp_msg_size; if (rx_req_idx >= hwc_rxq->msg_buf->num_reqs) { dev_err(hwc->dev, "HWC RX: wrong rx_req_idx=%llu, num_reqs=%u\n",
@@ -721,6 +721,15 @@ static int mana_hwc_init_queues(struct hw_channel_context *hwc, u16 q_depth, if (err) return err; + /* Set the queue dimensions before creating the CQ: doing so + * registers mana_hwc_rx_event_handler(), which divides by + * hwc->max_resp_msg_size and range-checks hwc->num_inflight_msg. + * They must be valid before any RX completion can be delivered. + */ + hwc->num_inflight_msg = q_depth; + hwc->max_req_msg_size = max_req_msg_size; + hwc->max_resp_msg_size = max_resp_msg_size; + /* CQ is shared by SQ and RQ, so CQ's queue depth is the sum of SQ * queue depth and RQ queue depth. */
@@ -733,23 +742,20 @@ static int mana_hwc_init_queues(struct hw_channel_context *hwc, u16 q_depth, goto out; } - err = mana_hwc_create_wq(hwc, GDMA_RQ, q_depth, max_req_msg_size, + err = mana_hwc_create_wq(hwc, GDMA_RQ, q_depth, max_resp_msg_size, hwc->cq, &hwc->rxq); if (err) { dev_err(hwc->dev, "Failed to create HWC RQ: %d\n", err); goto out; } - err = mana_hwc_create_wq(hwc, GDMA_SQ, q_depth, max_resp_msg_size, + err = mana_hwc_create_wq(hwc, GDMA_SQ, q_depth, max_req_msg_size, hwc->cq, &hwc->txq); if (err) { dev_err(hwc->dev, "Failed to create HWC SQ: %d\n", err); goto out; } - hwc->num_inflight_msg = q_depth; - hwc->max_req_msg_size = max_req_msg_size; - return 0; out: /* mana_hwc_create_channel() will do the cleanup.*/
diff --git a/include/net/mana/hw_channel.h b/include/net/mana/hw_channel.h
index 16feb39616c1..73671f479399 100644
--- a/include/net/mana/hw_channel.h
+++ b/include/net/mana/hw_channel.h@@ -181,6 +181,7 @@ struct hw_channel_context { u16 num_inflight_msg; u32 max_req_msg_size; + u32 max_resp_msg_size; u16 hwc_init_q_depth_max; u32 hwc_init_max_req_msg_size;
--
2.43.0