Re: [PATCH net v4 2/7] net: mana: fix HWC RQ/SQ buffer size swap

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unvalidated hardware/hypervisor input `inline_oob_size_div4` causes an out-of-bounds read of the DMA ring buffer, potentially leading to a guest kernel panic.
--

--- Patch [2]: [PATCH net v4 2/7] net: mana: fix HWC RQ/SQ buffer size swap ---
commit a84c17edbd298a723626b1c82f2d180dc7a76163
Author: Long Li <[email protected]>

net: mana: fix HWC RQ/SQ buffer size swap

This commit fixes a latent bug where the HWC RQ and SQ buffer sizes were
swapped during queue initialization. It corrects the RQ to use the max
response message size, the SQ to use the max request message size, and
updates the RX slot index computation to use the correct stride.

> diff --git a/drivers/net/ethernet/microsoft/mana/hw_channel.c b/drivers/net/ethernet/microsoft/mana/hw_channel.c
> index 409e20caeccdc..3f011ebbe7b3e 100644
> --- a/drivers/net/ethernet/microsoft/mana/hw_channel.c
> +++ b/drivers/net/ethernet/microsoft/mana/hw_channel.c
> @@ -263,7 +263,7 @@ static void mana_hwc_rx_event_handler(void *ctx, u32 gdma_rxq_id,
>  
>  	/* Select the RX work request for virtual address and for reposting. */
>  	rq_base_addr = hwc_rxq->msg_buf->mem_info.dma_handle;
> -	rx_req_idx = (sge->address - rq_base_addr) / hwc->max_req_msg_size;
> +	rx_req_idx = (sge->address - rq_base_addr) / hwc->max_resp_msg_size;

[Severity: High]
This is a pre-existing issue, but could an untrusted hypervisor or hardware
trigger an out-of-bounds read here when dereferencing sge->address?

In mana_hwc_rx_event_handler(), the driver computes the sge pointer using
dma_oob->inline_oob_size_div4, which is read from shared DMA memory. Because
this input is unvalidated, a malicious hypervisor in a Confidential VM
environment could potentially modify it.

If inline_oob_size_div4 is maliciously set to a large value like 7, the sge
calculation (wqe + 8 + dma_oob->inline_oob_size_div4 * 4) might yield a
pointer past the end of the DMA allocation boundary. The access to
sge->address on this line would then read out of bounds, potentially causing
a guest kernel panic.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=2