On Fri, Aug 25, 2023 at 10:04:41PM +0300, Mikhail Kobuk wrote:
+ Matt Carlson <mcarlson@xxxxxxxxxxxx>
> 'tp->irq_max' value is either 1 [L16336] or 5 [L16354], as indicated in
> tg3_get_invariants(). Therefore, 'i' can't exceed 4 in tg3_init_one()
> that makes (i <= 4) always true. Moreover, 'intmbx' value set at the
> last iteration is not used later in it's scope.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: 78f90dcf184b ("tg3: Move napi_add calls below tg3_get_invariants")
> Signed-off-by: Mikhail Kobuk <m.kobuk@xxxxxxxxx>
> Reviewed-by: Alexey Khoroshilov <khoroshilov@xxxxxxxxx>
> ---
> drivers/net/ethernet/broadcom/tg3.c | 5 +----
> 1 file changed, 1 insertion(+), 4 deletions(-)
>
> diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
> index 5ef073a79ce9..6b6da2484dfe 100644
> --- a/drivers/net/ethernet/broadcom/tg3.c
> +++ b/drivers/net/ethernet/broadcom/tg3.c
> @@ -17792,10 +17792,7 @@ static int tg3_init_one(struct pci_dev *pdev,
> tnapi->tx_pending = TG3_DEF_TX_RING_PENDING;
>
> tnapi->int_mbox = intmbx;
> - if (i <= 4)
> - intmbx += 0x8;
> - else
> - intmbx += 0x4;
> + intmbx += 0x8;
>
> tnapi->consmbox = rcvmbx;
> tnapi->prodmbox = sndmbx;
> --
> 2.42.0
>
>
