Bug 157118 - [igb] cleanup error in igb driver - igb_setup_receive_structures()
Summary: [igb] cleanup error in igb driver - igb_setup_receive_structures()
Status: Closed Works As Intended
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: Unspecified
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-05-17 14:10 UTC by aaron.styx
Modified: 2015-08-04 15:44 UTC (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description aaron.styx 2011-05-17 14:10:11 UTC
IGB driver version 2.0.7. I'm working from the release version of FreeBSD
v7.4. 

I'm not entirely sure what would be correct here, but in the function
igb_setup_receive_structures() in the e1000 igb driver (if_igb.c), the
fail condition looks wrong. At first glance, it looks like rxr should
get rx_rings[j], not [i]. Also, that code will never be run since the
condition on the for loop is j > i, i will be >= zero, and j starts at
zero.  

-STX

How-To-Repeat: I have not hit this code on a running system; just looked suspicious.
Comment 1 Sean Bruno freebsd_committer freebsd_triage 2015-08-04 15:44:36 UTC
The code appears to not match the description in this ticket anymore.  Closing it out.

static int
igb_setup_receive_structures(struct adapter *adapter)
{
        struct rx_ring *rxr = adapter->rx_rings;
        int i;

        for (i = 0; i < adapter->num_queues; i++, rxr++)
                if (igb_setup_receive_ring(rxr))
                        goto fail;

        return (0);
fail:
        /*
         * Free RX buffers allocated so far, we will only handle
         * the rings that completed, the failing case will have
         * cleaned up for itself. 'i' is the endpoint.
         */
        for (int j = 0; j < i; ++j) {
                rxr = &adapter->rx_rings[j];
                IGB_RX_LOCK(rxr);
                igb_free_receive_ring(rxr);
                IGB_RX_UNLOCK(rxr);
        }

        return (ENOBUFS);
}