linux-kernel - Re: [net,v2,1/2] net: liquidio: Fix off-by-one error in setup_nic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260126155039.1391193-1-horms@kernel.org>
Date: Mon, 26 Jan 2026 15:50:39 +0000
From: Simon Horman <horms@...nel.org>
To: zilin@....edu.cn
Cc: Simon Horman <horms@...nel.org>,
	davem@...emloft.net,
	andrew+netdev@...n.ch,
	jianhao.xu@....edu.cn,
	kuba@...nel.org,
	kory.maincent@...tlin.com,
	marco.crivellari@...e.com,
	linux-kernel@...r.kernel.org,
	netdev@...r.kernel.org,
	vadim.fedorenko@...ux.dev,
	edumazet@...gle.com,
	pabeni@...hat.com
Subject: Re: [net,v2,1/2] net: liquidio: Fix off-by-one error in setup_nic_devices() cleanup

This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.

For local reproduction steps see https://netdev-ai.bots.linux.dev/ai-local.html
---
net: liquidio: Fix off-by-one error in setup_nic_devices() cleanup

This patch changes the cleanup loop from while(i--) to do{}while(i--)
to ensure that when a device fails to initialize, it gets cleaned up
along with all previously initialized devices.

> diff --git a/drivers/net/ethernet/cavium/liquidio/lio_main.c b/drivers/net/ethernet/cavium/liquidio/lio_main.c
> index 0732440eeacd..3ba2806f5d1e 100644
> --- a/drivers/net/ethernet/cavium/liquidio/lio_main.c
> +++ b/drivers/net/ethernet/cavium/liquidio/lio_main.c
> @@ -3765,11 +3765,11 @@ static int setup_nic_devices(struct octeon_device *octeon_dev)
>
>  setup_nic_dev_free:
>
> -	while (i--) {
> +	do {
>  		dev_err(&octeon_dev->pci_dev->dev,
>  			"NIC ifidx:%d Setup failed\n", i);
>  		liquidio_destroy_nic_device(octeon_dev, i);
> -	}
> +	} while (i--);

In lio_main.c, setup_nic_devices() can also reach setup_nic_dev_free from
the devlink_alloc() failure path after the main for loop completes. At that
point i equals ifcount (the loop counter has been incremented past the last
valid device).

With the do-while change, the first iteration will call
liquidio_destroy_nic_device(octeon_dev, ifcount) for a device index that
was never initialized. The function has a guard for NULL netdev so it will
not crash, but it will print a spurious error message about a device that
never existed.

The fix works correctly for failures within the loop (which is the case
described in the commit message), but is there a way to handle the
post-loop devlink_alloc() failure case without printing the spurious
error message?

[ ... ]
-- 
pw-bot: cr