Re: [PATCH v18 net-next 5/8] octeontx2: cn20k: Coordinate default rules with NIX LF lifecycle

[Ratheesh Kannoth]

On 2026-06-02 at 11:33:56, Ratheesh Kannoth (rkannoth@xxxxxxxxxxx) wrote:
> Add NIX_LF_DONT_FREE_DFT_IDXS so the PF can send NIX LF free during hw
> reinit or teardown without the AF freeing CN20K default NPC rule indexes
> while the driver still owns that state (otx2_init_hw_resources and
> otx2_free_hw_resources).
>
> On CN20K, allocate default NPC rules from NIX LF alloc before
> nix_interface_init, roll back with npc_cn20k_dft_rules_free on failure,
> and free from NIX LF free when the new flag is not set. Tighten
> rvu_mbox_handler_nix_lf_alloc error handling: use a single rc, propagate
> qmem_alloc and other errors, and set -ENOMEM only when kcalloc fails
> (remove the blanket -ENOMEM at the free_mem path).
>
> Signed-off-by: Ratheesh Kannoth <rkannoth@xxxxxxxxxxx>

https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260602060359.1894952-1-rkannoth%40marvell.com says:

>4. nix_interface_init() then calls
>   nix_update_mce_rule(NIXLF_BCAST_ENTRY, true), which can fail (for
>   example -EINVAL from npc_get_nixlf_mcam_index in the cn20k path,
>   or kzalloc failure in nix_update_mce_list).
>5. The new error path goto free_dft -> npc_cn20k_dft_rules_free()
>   walks mcam->mcam_rules and kfree()s every rule whose entry matches
>   one of the freed dft indexes, including the rule installed in
>   step 3.
>6. pfvf->def_ucast_rule is not cleared, so it now points at freed
>   memory.
>Subsequent mbox traffic for the same pcifunc dereferences that
>dangling pointer in places like:
If nix lf alloc fails, subsequent mbox traffic wont come for that Pcifunc.
Next nix_lf alloc, would alloc default mcam rules. Practically this is not possible.
I will add an hardening patchseries to remove the idempotency attribute of
npc_cn20k_dft_rules_alloc() after this series is merged.