Re: [PATCH net-next v13 2/2] net: mana: force full-page RX buffers via ethtool private flag

On Thu, Jul 30, 2026 at 06:34:37AM +0000, [email protected] wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [High] Use-after-free of BPF program when mana_pre_alloc_rxbufs fails during XDP setup
> --
> 
> --- Patch [2]: [PATCH net-next v13 2/2] net: mana: force full-page RX buffers via ethtool private flag ---
> commit 2ea505589c71d255969461add82f06436f8f8e80
> Author: Dipayaan Roy <[email protected]>
> 
> net: mana: force full-page RX buffers via ethtool private flag
> 
> This commit adds an ethtool private flag to force one RX buffer per page,
> bypassing the page_pool fragment path. This is intended to restore
> line-rate throughput on certain ARM64 platforms with 4K PAGE_SIZE.
> 
> > diff --git a/drivers/net/ethernet/microsoft/mana/mana_ethtool.c b/drivers/net/ethernet/microsoft/mana/mana_ethtool.c
> > index 482cd16009abb..7e441d6ae5dce 100644
> > --- a/drivers/net/ethernet/microsoft/mana/mana_ethtool.c
> > +++ b/drivers/net/ethernet/microsoft/mana/mana_ethtool.c
> [ ... ]
> > @@ -756,6 +775,78 @@ static int mana_get_link_ksettings(struct net_device *ndev,
> [ ... ]
> > +static int mana_set_priv_flags(struct net_device *ndev, u32 priv_flags)
> > +{
> [ ... ]
> > +	if (changed & BIT(MANA_PRIV_FLAG_USE_FULL_PAGE_RXBUF)) {
> [ ... ]
> > +		err = mana_pre_alloc_rxbufs(apc, ndev->mtu, apc->num_queues);
> > +		if (err) {
> > +			netdev_err(ndev,
> > +				   "Insufficient memory for new allocations\n");
> > +			apc->priv_flags = old_priv_flags;
> > +			goto clear_flag;
> > +		}
> 
> [Severity: High]
> This isn't a bug introduced by this patch, but while reviewing the callers
> of mana_pre_alloc_rxbufs(), does a failure during XDP setup leave a dangling
> pointer?
> 
> In drivers/net/ethernet/microsoft/mana/mana_bpf.c:mana_xdp_set(),
> apc->bpf_prog is updated before the allocation:
> 
>         apc->bpf_prog = prog;
> 
> If the allocation fails, the function returns early without cleaning up:
> 
>         err = mana_pre_alloc_rxbufs(apc, ndev->mtu, apc->num_queues);
>         if (err) {
>                 NL_SET_ERR_MSG_MOD(extack,
>                                    "XDP: Insufficient memory ...");
>                 return err;
>         }
> 
> The core network stack handles the error by releasing its reference to the
> new BPF program, which may then be freed. Because the early return skips
> the err_dealloc_rxbuffs label, apc->bpf_prog is never reverted to old_prog.
> Could a subsequent interface flap execute mana_attach() and assign this
> freed BPF program to the hardware RX queues, causing a use-after-free?
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=2

As this Sashiko comment is for a pre-exisiting issue and not related to
this patch, will send out a different patch for this.


Regards
Dipayaan Roy