vmxnet3: coverity woe

Coverity complains that hb might be null when !prev_b0 is true. It may be right, but not likely.
To make the code more explicit when it parses a complete packet, set got_packet = 1 and test
got_packet instead of prev_b0 which is somewhat obscure.

Use vlib_buffer_free_one rather than vlib_buffer_free_no_next in output.c which takes care of
chain buffers.

Change-Id: I6e0587605fdc622c3f55fedd74c474666631ed91
Signed-off-by: Steven <sluong@cisco.com>

diff --git a/src/plugins/vmxnet3/input.c b/src/plugins/vmxnet3/input.c
index cdd3c7b..4ff459a 100644 (file)
--- a/src/plugins/vmxnet3/input.c
+++ b/src/plugins/vmxnet3/input.c
@@ -90,7 +90,7 @@ vmxnet3_device_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
   u16 rid;
   vlib_buffer_t *prev_b0 = 0, *hb = 0;
   u32 next_index = VNET_DEVICE_INPUT_NEXT_ETHERNET_INPUT;
-  u8 known_next = 0;
+  u8 known_next = 0, got_packet = 0;
   vmxnet3_rx_desc *rxd;
   clib_error_t *error;
 
@@ -173,6 +173,7 @@ vmxnet3_device_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
               * Both start and end of packet is set. It is a complete packet
               */
              prev_b0 = 0;
+             got_packet = 1;
            }
        }
       else if (rx_comp->index & VMXNET3_RXCI_EOP)
@@ -184,7 +185,8 @@ vmxnet3_device_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
              prev_b0->next_buffer = bi0;
              hb->total_length_not_including_first_buffer +=
                b0->current_length;
-             prev_b0 = 0;      // Get next packet
+             prev_b0 = 0;
+             got_packet = 1;
            }
          else
            {
@@ -216,7 +218,7 @@ vmxnet3_device_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 
       n_rx_bytes += b0->current_length;
 
-      if (!prev_b0)
+      if (got_packet)
        {
          ethernet_header_t *e = (ethernet_header_t *) hb->data;
 
@@ -271,6 +273,7 @@ vmxnet3_device_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
          next++;
          bi++;
          hb = 0;
+         got_packet = 0;
        }
     }
 

diff --git a/src/plugins/vmxnet3/output.c b/src/plugins/vmxnet3/output.c
index d6b7aaa..bcb0294 100644 (file)
--- a/src/plugins/vmxnet3/output.c
+++ b/src/plugins/vmxnet3/output.c
@@ -59,25 +59,22 @@ vmxnet3_txq_release (vlib_main_t * vm, vmxnet3_device_t * vd,
                     vmxnet3_txq_t * txq)
 {
   vmxnet3_tx_comp *tx_comp;
-  u32 bi0;
   vmxnet3_tx_comp_ring *comp_ring;
-  u16 eop_idx, desc_idx;
 
   comp_ring = &txq->tx_comp_ring;
   tx_comp = &txq->tx_comp[comp_ring->next];
 
   while ((tx_comp->flags & VMXNET3_TXCF_GEN) == comp_ring->gen)
     {
-      eop_idx = tx_comp->index & VMXNET3_TXC_INDEX;
-      do
+      u16 eop_idx = tx_comp->index & VMXNET3_TXC_INDEX;
+      u32 bi0 = txq->tx_ring.bufs[txq->tx_ring.consume];
+
+      vlib_buffer_free_one (vm, bi0);
+      while (txq->tx_ring.consume != eop_idx)
        {
-         desc_idx = txq->tx_ring.consume;
-         bi0 = txq->tx_ring.bufs[desc_idx];
-         txq->tx_ring.bufs[desc_idx] = ~0;
-         vlib_buffer_free_no_next (vm, &bi0, 1);
          vmxnet3_tx_ring_advance_consume (txq);
        }
-      while (desc_idx != eop_idx);
+      vmxnet3_tx_ring_advance_consume (txq);
 
       vmxnet3_tx_comp_ring_advance_next (txq);
       tx_comp = &txq->tx_comp[comp_ring->next];