[PATCH v2 net 0/9] net: enetc: SR-IOV robustness and security fixes

Wei Fang posted 9 patches 1 week ago
There is a newer version of this series
.../net/ethernet/freescale/enetc/enetc_hw.h   |  1 +
.../net/ethernet/freescale/enetc/enetc_msg.c  | 79 ++++++++++---------
.../net/ethernet/freescale/enetc/enetc_pf.c   | 75 +++++++++++++-----
.../net/ethernet/freescale/enetc/enetc_pf.h   |  1 +
4 files changed, 98 insertions(+), 58 deletions(-)
[PATCH v2 net 0/9] net: enetc: SR-IOV robustness and security fixes
Posted by Wei Fang 1 week ago
This patch series addresses a number of robustness, security, and
correctness issues in the ENETC driver's SR-IOV subsystem, focusing
primarily on the VF-to-PF mailbox communication path.

The series can be grouped into the following categories:

1. DoS and security fixes:
   - Prevent an unbounded loop DoS in the VF-to-PF message handler,
     which could be triggered by a malicious or misbehaving VF.
   - Fix a TOCTOU (Time-of-Check-Time-of-Use) race and add proper
     validation of VF MAC addresses to prevent spoofing or invalid
     configuration from being applied.

2. Race condition fixes:
   - Fix a race condition in VF MAC address configuration that could
     lead to inconsistent state between the VF request and PF
     application.
   - Fix a race condition during SR-IOV teardown that could cause
     VF->PF mailbox operations to time out, resulting in unnecessary
     errors during shutdown.

3. Memory safety fixes:
   - Fix a DMA write to freed memory in enetc_msg_free_mbx(), which
     could cause silent memory corruption or system instability.

4. Error handling and initialization fixes:
   - Fix missing error code propagation when pf->vf_state allocation
     fails, ensuring callers receive a proper errno instead of
     succeeding silently.
   - Fix incorrect mailbox message status values returned to VFs,
     which could cause VFs to misinterpret PF responses.
   - Fix initialization order to prevent the use of uninitialized
     resources during driver probe, which could cause undefined
     behavior on certain configurations.

5. Diagnostics improvement:
   - Add rate limiting to VF mailbox error messages to prevent log
     flooding in the presence of a misbehaving VF.

These fixes improve the overall stability and security of the ENETC
SR-IOV implementation, particularly in multi-tenant environments where
VFs may be assigned to untrusted guests.

---
v2:
1. Copy the message content from DMA memory to local memory
2. Patch 3 and 5 in v1 are merged into patch 8 in v2
3. Add more fix patches, such as patch 1, 2, 6 and 7
v1 link: https://lore.kernel.org/imx/20260513103021.2190593-1-wei.fang@nxp.com/
---

Wei Fang (9):
  net: enetc: fix incorrect mailbox message status returned to VFs
  net: enetc: fix missing error code when pf->vf_state allocation fails
  net: enetc: add ratelimiting to VF mailbox error messages
  net: enetc: fix TOCTOU race and validate VF MAC address
  net: enetc: fix race condition in VF MAC address configuration
  net: enetc: fix DMA write to freed memory in enetc_msg_free_mbx()
  net: enetc: fix VF-to-PF message handler unbounded loop DoS
  net: enetc: fix initialization order to prevent use of uninitialized
    resources
  net: enetc: avoid VF->PF mailbox timeout during SR-IOV teardown

 .../net/ethernet/freescale/enetc/enetc_hw.h   |  1 +
 .../net/ethernet/freescale/enetc/enetc_msg.c  | 79 ++++++++++---------
 .../net/ethernet/freescale/enetc/enetc_pf.c   | 75 +++++++++++++-----
 .../net/ethernet/freescale/enetc/enetc_pf.h   |  1 +
 4 files changed, 98 insertions(+), 58 deletions(-)

-- 
2.34.1
Re: [PATCH v2 net 0/9] net: enetc: SR-IOV robustness and security fixes
Posted by Harshitha Ramamurthy 5 days, 11 hours ago
On Sun, May 17, 2026 at 8:03 PM Wei Fang <wei.fang@nxp.com> wrote:
>
> This patch series addresses a number of robustness, security, and
> correctness issues in the ENETC driver's SR-IOV subsystem, focusing
> primarily on the VF-to-PF mailbox communication path.
>
> The series can be grouped into the following categories:
>
> 1. DoS and security fixes:
>    - Prevent an unbounded loop DoS in the VF-to-PF message handler,
>      which could be triggered by a malicious or misbehaving VF.
>    - Fix a TOCTOU (Time-of-Check-Time-of-Use) race and add proper
>      validation of VF MAC addresses to prevent spoofing or invalid
>      configuration from being applied.
>
> 2. Race condition fixes:
>    - Fix a race condition in VF MAC address configuration that could
>      lead to inconsistent state between the VF request and PF
>      application.
>    - Fix a race condition during SR-IOV teardown that could cause
>      VF->PF mailbox operations to time out, resulting in unnecessary
>      errors during shutdown.
>
> 3. Memory safety fixes:
>    - Fix a DMA write to freed memory in enetc_msg_free_mbx(), which
>      could cause silent memory corruption or system instability.
>
> 4. Error handling and initialization fixes:
>    - Fix missing error code propagation when pf->vf_state allocation
>      fails, ensuring callers receive a proper errno instead of
>      succeeding silently.
>    - Fix incorrect mailbox message status values returned to VFs,
>      which could cause VFs to misinterpret PF responses.
>    - Fix initialization order to prevent the use of uninitialized
>      resources during driver probe, which could cause undefined
>      behavior on certain configurations.
>
> 5. Diagnostics improvement:
>    - Add rate limiting to VF mailbox error messages to prevent log
>      flooding in the presence of a misbehaving VF.
>
> These fixes improve the overall stability and security of the ENETC
> SR-IOV implementation, particularly in multi-tenant environments where
> VFs may be assigned to untrusted guests.
>
> ---
> v2:
> 1. Copy the message content from DMA memory to local memory
> 2. Patch 3 and 5 in v1 are merged into patch 8 in v2
> 3. Add more fix patches, such as patch 1, 2, 6 and 7
> v1 link: https://lore.kernel.org/imx/20260513103021.2190593-1-wei.fang@nxp.com/
> ---
>
> Wei Fang (9):
>   net: enetc: fix incorrect mailbox message status returned to VFs
>   net: enetc: fix missing error code when pf->vf_state allocation fails
>   net: enetc: add ratelimiting to VF mailbox error messages
>   net: enetc: fix TOCTOU race and validate VF MAC address
>   net: enetc: fix race condition in VF MAC address configuration
>   net: enetc: fix DMA write to freed memory in enetc_msg_free_mbx()
>   net: enetc: fix VF-to-PF message handler unbounded loop DoS
>   net: enetc: fix initialization order to prevent use of uninitialized
>     resources
>   net: enetc: avoid VF->PF mailbox timeout during SR-IOV teardown

Resending to the correct thread.

This v2 series LGTM. If the commit message for patch 8 is updated,
feel free to add:

Reviewed-by: Harshitha Ramamurthy <hramamurthy@google.com>

>
>  .../net/ethernet/freescale/enetc/enetc_hw.h   |  1 +
>  .../net/ethernet/freescale/enetc/enetc_msg.c  | 79 ++++++++++---------
>  .../net/ethernet/freescale/enetc/enetc_pf.c   | 75 +++++++++++++-----
>  .../net/ethernet/freescale/enetc/enetc_pf.h   |  1 +
>  4 files changed, 98 insertions(+), 58 deletions(-)
>
> --
> 2.34.1
>
>