linux-kernel - Re: [net,v2,1/2] net: liquidio: Fix off-by-one error in setup_nic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20260127100648.957628-1-zilin@seu.edu.cn>
Date: Tue, 27 Jan 2026 10:06:48 +0000
From: Zilin Guan <zilin@....edu.cn>
To: horms@...nel.org
Cc: andrew+netdev@...n.ch,
	davem@...emloft.net,
	edumazet@...gle.com,
	jianhao.xu@....edu.cn,
	kory.maincent@...tlin.com,
	kuba@...nel.org,
	linux-kernel@...r.kernel.org,
	marco.crivellari@...e.com,
	netdev@...r.kernel.org,
	pabeni@...hat.com,
	vadim.fedorenko@...ux.dev,
	zilin@....edu.cn
Subject: Re: [net,v2,1/2] net: liquidio: Fix off-by-one error in setup_nic_devices() cleanup

On Mon, Jan 26, 2026 at 03:56:07PM +0000, Simon Horman wrote:
> On Mon, Jan 26, 2026 at 03:50:39PM +0000, Simon Horman wrote:
> > This is an AI-generated review of your patch. The human sending this
> > email has considered the AI review valid, or at least plausible.
> > 
> > For local reproduction steps see https://netdev-ai.bots.linux.dev/ai-local.html
> > ---
> > net: liquidio: Fix off-by-one error in setup_nic_devices() cleanup
> > 
> > This patch changes the cleanup loop from while(i--) to do{}while(i--)
> > to ensure that when a device fails to initialize, it gets cleaned up
> > along with all previously initialized devices.
> > 
> > > diff --git a/drivers/net/ethernet/cavium/liquidio/lio_main.c b/drivers/net/ethernet/cavium/liquidio/lio_main.c
> > > index 0732440eeacd..3ba2806f5d1e 100644
> > > --- a/drivers/net/ethernet/cavium/liquidio/lio_main.c
> > > +++ b/drivers/net/ethernet/cavium/liquidio/lio_main.c
> > > @@ -3765,11 +3765,11 @@ static int setup_nic_devices(struct octeon_device *octeon_dev)
> > >
> > >  setup_nic_dev_free:
> > >
> > > -	while (i--) {
> > > +	do {
> > >  		dev_err(&octeon_dev->pci_dev->dev,
> > >  			"NIC ifidx:%d Setup failed\n", i);
> > >  		liquidio_destroy_nic_device(octeon_dev, i);
> > > -	}
> > > +	} while (i--);
> > 
> > In lio_main.c, setup_nic_devices() can also reach setup_nic_dev_free from
> > the devlink_alloc() failure path after the main for loop completes. At that
> > point i equals ifcount (the loop counter has been incremented past the last
> > valid device).
> > 
> > With the do-while change, the first iteration will call
> > liquidio_destroy_nic_device(octeon_dev, ifcount) for a device index that
> > was never initialized. The function has a guard for NULL netdev so it will
> > not crash, but it will print a spurious error message about a device that
> > never existed.
> > 
> > The fix works correctly for failures within the loop (which is the case
> > described in the commit message), but is there a way to handle the
> > post-loop devlink_alloc() failure case without printing the spurious
> > error message?
> 
> Sorry for not realising this when I made this suggestion in
> my review of v1.
> 
> Also, I would suggest splitting this patch in two: one patch
> per driver.

Hi Simon,

Apologies from my side as well; I overlooked the devlink_alloc failure 
path myself.

As noted, the loop index i is indeed invalid at that point. I will fix
this by decrementing i in the error path to ensure it points to the last
successfully initialized device before cleanup.

I will also split this patch into two separate patches in v3 as requested.

Regards,
Zilin