Re: [PATCH net-next v10 2/4] net: mana: give each HWC message slot its own completion state

[Wei Hu]

Thanks for the review.

I will include the small metadata follow-up below in v11. The four Medium
findings are pre-existing and will be addressed separately. Where later
patches already provide protection in the completed feature series, I
have noted that distinction below.

> These changes fix bugs that can already be hit in the baseline, but the
> commit has no Fixes: tag and no stable note. Should it have them?

Agreed. I verified the original-driver commit ca9c54d2d6a5 and will add
the applicable Fixes metadata. I will explicitly describe the stale
caller-storage and stale-completion bugs, and make the dependency on the
following quarantine patch clear for backporters.

Patch 2 alone does not solve response correlation or TX-buffer reuse after
a timeout. The backport guidance will say so; I am not proposing automatic
stable pickup of the complete feature stack.

> This isn't a bug introduced by this patch, but can a late response for a
> request that timed out still reach the next request that reuses the same
> msg_id?

This is pre-existing. We will address it separately for the baseline.
As the review notes, patch 3 already keeps the ID quarantined in the
completed series. That protection will be preserved in the respin.

> This isn't a bug introduced by this patch, but can this memcpy() read past
> the end of the RX slot?

This is pre-existing. We will address it separately for the baseline.
Patch 4 already checks the requested response size against the effective
RX limit and slot capacity before admission in the completed series.
This is not a claim that standalone patch 2 fixes the bound.

> This is a pre-existing issue, but is the TX DMA buffer for this msg_id safe
> to reuse at this point?

The early TX-buffer reuse is pre-existing. We will address it separately
for the baseline. In the completed feature series, patch 3 retains the
slot and its TX buffer while the response-side ownership is outstanding.
The respin will not undo that quarantine to make admission succeed.

> This isn't a bug introduced by this patch, but the caller of this
> function, mana_hwc_rx_event_handler(), drops the RX buffer when the device
> sends an out-of-range msg_id:

The missing RX-buffer repost is pre-existing and remains outside this
series' changes. We will address it separately, rather than silently
folding an unrelated RX recovery fix into this respin.

Regards,
Wei