On Sun, May 17, 2026 at 8:03 PM Wei Fang <wei.fang@nxp.com> wrote:
>
> This patch series addresses a number of robustness, security, and
> correctness issues in the ENETC driver's SR-IOV subsystem, focusing
> primarily on the VF-to-PF mailbox communication path.
>
> The series can be grouped into the following categories:
>
> 1. DoS and security fixes:
> - Prevent an unbounded loop DoS in the VF-to-PF message handler,
> which could be triggered by a malicious or misbehaving VF.
> - Fix a TOCTOU (Time-of-Check-Time-of-Use) race and add proper
> validation of VF MAC addresses to prevent spoofing or invalid
> configuration from being applied.
>
> 2. Race condition fixes:
> - Fix a race condition in VF MAC address configuration that could
> lead to inconsistent state between the VF request and PF
> application.
> - Fix a race condition during SR-IOV teardown that could cause
> VF->PF mailbox operations to time out, resulting in unnecessary
> errors during shutdown.
>
> 3. Memory safety fixes:
> - Fix a DMA write to freed memory in enetc_msg_free_mbx(), which
> could cause silent memory corruption or system instability.
>
> 4. Error handling and initialization fixes:
> - Fix missing error code propagation when pf->vf_state allocation
> fails, ensuring callers receive a proper errno instead of
> succeeding silently.
> - Fix incorrect mailbox message status values returned to VFs,
> which could cause VFs to misinterpret PF responses.
> - Fix initialization order to prevent the use of uninitialized
> resources during driver probe, which could cause undefined
> behavior on certain configurations.
>
> 5. Diagnostics improvement:
> - Add rate limiting to VF mailbox error messages to prevent log
> flooding in the presence of a misbehaving VF.
>
> These fixes improve the overall stability and security of the ENETC
> SR-IOV implementation, particularly in multi-tenant environments where
> VFs may be assigned to untrusted guests.
>
> ---
> v2:
> 1. Copy the message content from DMA memory to local memory
> 2. Patch 3 and 5 in v1 are merged into patch 8 in v2
> 3. Add more fix patches, such as patch 1, 2, 6 and 7
> v1 link: https://lore.kernel.org/imx/20260513103021.2190593-1-wei.fang@nxp.com/
> ---
>
> Wei Fang (9):
> net: enetc: fix incorrect mailbox message status returned to VFs
> net: enetc: fix missing error code when pf->vf_state allocation fails
> net: enetc: add ratelimiting to VF mailbox error messages
> net: enetc: fix TOCTOU race and validate VF MAC address
> net: enetc: fix race condition in VF MAC address configuration
> net: enetc: fix DMA write to freed memory in enetc_msg_free_mbx()
> net: enetc: fix VF-to-PF message handler unbounded loop DoS
> net: enetc: fix initialization order to prevent use of uninitialized
> resources
> net: enetc: avoid VF->PF mailbox timeout during SR-IOV teardown
Resending to the correct thread.
This v2 series LGTM. If the commit message for patch 8 is updated,
feel free to add:
Reviewed-by: Harshitha Ramamurthy <hramamurthy@google.com>
>
> .../net/ethernet/freescale/enetc/enetc_hw.h | 1 +
> .../net/ethernet/freescale/enetc/enetc_msg.c | 79 ++++++++++---------
> .../net/ethernet/freescale/enetc/enetc_pf.c | 75 +++++++++++++-----
> .../net/ethernet/freescale/enetc/enetc_pf.h | 1 +
> 4 files changed, 98 insertions(+), 58 deletions(-)
>
> --
> 2.34.1
>
>