Thread (9 messages) 9 messages, 2 authors, 2026-01-27

Re: [net,v2,1/2] net: liquidio: Fix off-by-one error in setup_nic_devices() cleanup

From: Zilin Guan <hidden>
Date: 2026-01-27 10:07:00
Also in: lkml

On Mon, Jan 26, 2026 at 03:56:07PM +0000, Simon Horman wrote:
On Mon, Jan 26, 2026 at 03:50:39PM +0000, Simon Horman wrote:
quoted
This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.

For local reproduction steps see https://netdev-ai.bots.linux.dev/ai-local.html
---
net: liquidio: Fix off-by-one error in setup_nic_devices() cleanup

This patch changes the cleanup loop from while(i--) to do{}while(i--)
to ensure that when a device fails to initialize, it gets cleaned up
along with all previously initialized devices.
quoted
diff --git a/drivers/net/ethernet/cavium/liquidio/lio_main.c b/drivers/net/ethernet/cavium/liquidio/lio_main.c
index 0732440eeacd..3ba2806f5d1e 100644
--- a/drivers/net/ethernet/cavium/liquidio/lio_main.c
+++ b/drivers/net/ethernet/cavium/liquidio/lio_main.c
@@ -3765,11 +3765,11 @@ static int setup_nic_devices(struct octeon_device *octeon_dev)

 setup_nic_dev_free:

-	while (i--) {
+	do {
 		dev_err(&octeon_dev->pci_dev->dev,
 			"NIC ifidx:%d Setup failed\n", i);
 		liquidio_destroy_nic_device(octeon_dev, i);
-	}
+	} while (i--);
In lio_main.c, setup_nic_devices() can also reach setup_nic_dev_free from
the devlink_alloc() failure path after the main for loop completes. At that
point i equals ifcount (the loop counter has been incremented past the last
valid device).

With the do-while change, the first iteration will call
liquidio_destroy_nic_device(octeon_dev, ifcount) for a device index that
was never initialized. The function has a guard for NULL netdev so it will
not crash, but it will print a spurious error message about a device that
never existed.

The fix works correctly for failures within the loop (which is the case
described in the commit message), but is there a way to handle the
post-loop devlink_alloc() failure case without printing the spurious
error message?
Sorry for not realising this when I made this suggestion in
my review of v1.

Also, I would suggest splitting this patch in two: one patch
per driver.
Hi Simon,

Apologies from my side as well; I overlooked the devlink_alloc failure 
path myself.

As noted, the loop index i is indeed invalid at that point. I will fix
this by decrementing i in the error path to ensure it points to the last
successfully initialized device before cleanup.

I will also split this patch into two separate patches in v3 as requested.

Regards,
Zilin
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help