ibmveth: fix open-fail unwind after LAN registration

ibmveth_open() registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out_free_buffer_pools without h_free_logical_lan(), so PHYP still owns the buffer-list page when it is unmapped. request_irq() failure already issued the hypercall before taking the same label.

Move that h_free to the shared post-register unwind so both paths deregister before the buffer list is unmapped.

Fixes d43732ce021f ("ibmveth: properly unwind on init errors")

Cc [email protected]

Signed-off-by Mingming Cao <[email protected]>

---
 drivers/net/ethernet/ibm/ibmveth.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

drivers/net/ethernet/ibm/ibmveth.c +0 -0

index 73e051d26b9d..3e44f6b714d4 100644

This code change is good. But I noticed another thing that's a pretty minor bug of useless code just after this:

	rc = -ENOMEM;

rc isn't used in that code path after it is set. Is there some reason I do not understand to have this here?

Quoted 7 lines · Dave Marquardt

This code change is good. But I noticed another thing that's a pretty minor bug of useless code just after this:

	rc = -ENOMEM;

rc isn't used in that code path after it is set. Is there some reason I do not understand to have this here?

Yeah, that |rc = -ENOMEM| at line 728 is dead — set right before

|return 0| and never read again. Pre-existing junk. |d43732| set it
for the bounce alloc that used to run next. |d6832| moved the TX LTB
earlier and dropped the bounce, but left the line. After |request_irq|

succeeds we replenish, start TX, and return 0.

It's harmless (not user-visible) — I prefer leaving it out of this Fixes and letting the MQ series clean it up naturally when it rewrites that whole open() path. But fine to respin a new version if desired.

out_free_buffer_pools reuses open()'s loop index for the TX LTB walk. After the pool unwind i is -1, so the TX buffers allocated earlier are leaked. request_irq() failure has the same leak.

The TX-fail goto on that walk also skips dma_unmap of the filter list (pre-existing since the LTB was added). Rewrite the TX walk to real_num_tx_queues with a pointer check, and unmap the filter list before those frees.

Fixes d926793c1de9 ("ibmveth: Implement multi queue on xmit")

Cc [email protected]

Signed-off-by Mingming Cao <[email protected]>

---
 drivers/net/ethernet/ibm/ibmveth.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

drivers/net/ethernet/ibm/ibmveth.c +8 -3

index 3e44f6b714d4..abebdb1fc262 100644
@@ -553,10 +553,15 @@ static int ibmveth_rxq_harvest_buffer(struct ibmveth_adapter *adapter,
 
 static void ibmveth_free_tx_ltb(struct ibmveth_adapter *adapter, int idx)
 {
+	void *ptr = adapter->tx_ltb_ptr[idx];
+
+	if (!ptr)
+		return;
+
+	adapter->tx_ltb_ptr[idx] = NULL;
 	dma_unmap_single(&adapter->vdev->dev, adapter->tx_ltb_dma[idx],
 			 adapter->tx_ltb_size, DMA_TO_DEVICE);
-	kfree(adapter->tx_ltb_ptr[idx]);
-	adapter->tx_ltb_ptr[idx] = NULL;
+	kfree(ptr);
 }
 
 static int ibmveth_allocate_tx_ltb(struct ibmveth_adapter *adapter, int idx)

@@ -667,7 +672,7 @@ static int ibmveth_open(struct net_device *netdev)
 
 	for (i = 0; i < netdev->real_num_tx_queues; i++) {
 		if (ibmveth_allocate_tx_ltb(adapter, i))
-			goto out_free_tx_ltb;
+			goto out_unmap_filter_list;
 	}
 
 	adapter->rx_queue.index = 0;

@@ -745,10 +750,8 @@ static int ibmveth_open(struct net_device *netdev)
 	dma_unmap_single(dev, adapter->filter_list_dma, 4096,