'tp->irq_max' value is either 1 [L16336] or 5 [L16354], as indicated in
tg3_get_invariants(). Therefore, 'i' can't exceed 4 in tg3_init_one()
that makes (i <= 4) always true. Moreover, 'intmbx' value set at the
last iteration is not used later in it's scope.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 78f90dcf184b ("tg3: Move napi_add calls below tg3_get_invariants")
Signed-off-by: Mikhail Kobuk <m.kobuk@ispras.ru>
Reviewed-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
---
 drivers/net/ethernet/broadcom/tg3.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 5ef073a79ce9..6b6da2484dfe 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -17792,10 +17792,7 @@ static int tg3_init_one(struct pci_dev *pdev,
 		tnapi->tx_pending = TG3_DEF_TX_RING_PENDING;
 
 		tnapi->int_mbox = intmbx;
-		if (i <= 4)
-			intmbx += 0x8;
-		else
-			intmbx += 0x4;
+		intmbx += 0x8;
 
 		tnapi->consmbox = rcvmbx;
 		tnapi->prodmbox = sndmbx;
-- 
2.42.0

Hello:

This patch was applied to netdev/net.git (main)
by David S. Miller <davem@davemloft.net>:

On Fri, 25 Aug 2023 22:04:41 +0300 you wrote:
> 'tp->irq_max' value is either 1 [L16336] or 5 [L16354], as indicated in
> tg3_get_invariants(). Therefore, 'i' can't exceed 4 in tg3_init_one()
> that makes (i <= 4) always true. Moreover, 'intmbx' value set at the
> last iteration is not used later in it's scope.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> [...]

Here is the summary with links:
  - ethernet: tg3: remove unreachable code
    https://git.kernel.org/netdev/net/c/ec1b90886f3c

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

On Fri, Aug 25, 2023 at 10:04:41PM +0300, Mikhail Kobuk wrote:

+ Matt Carlson <mcarlson@broadcom.com>

> 'tp->irq_max' value is either 1 [L16336] or 5 [L16354], as indicated in
> tg3_get_invariants(). Therefore, 'i' can't exceed 4 in tg3_init_one()
> that makes (i <= 4) always true. Moreover, 'intmbx' value set at the
> last iteration is not used later in it's scope.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: 78f90dcf184b ("tg3: Move napi_add calls below tg3_get_invariants")
> Signed-off-by: Mikhail Kobuk <m.kobuk@ispras.ru>
> Reviewed-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
> ---
>  drivers/net/ethernet/broadcom/tg3.c | 5 +----
>  1 file changed, 1 insertion(+), 4 deletions(-)
> 
> diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
> index 5ef073a79ce9..6b6da2484dfe 100644
> --- a/drivers/net/ethernet/broadcom/tg3.c
> +++ b/drivers/net/ethernet/broadcom/tg3.c
> @@ -17792,10 +17792,7 @@ static int tg3_init_one(struct pci_dev *pdev,
>  		tnapi->tx_pending = TG3_DEF_TX_RING_PENDING;
>  
>  		tnapi->int_mbox = intmbx;
> -		if (i <= 4)
> -			intmbx += 0x8;
> -		else
> -			intmbx += 0x4;
> +		intmbx += 0x8;
>  
>  		tnapi->consmbox = rcvmbx;
>  		tnapi->prodmbox = sndmbx;
> -- 
> 2.42.0
> 
>

On Sun, Aug 27, 2023 at 9:51 AM Simon Horman <horms@kernel.org> wrote:
>
> On Fri, Aug 25, 2023 at 10:04:41PM +0300, Mikhail Kobuk wrote:
>
> + Matt Carlson <mcarlson@broadcom.com>

Matt Carlson is no longer working for Broadcom.

>
> > 'tp->irq_max' value is either 1 [L16336] or 5 [L16354], as indicated in
> > tg3_get_invariants(). Therefore, 'i' can't exceed 4 in tg3_init_one()
> > that makes (i <= 4) always true. Moreover, 'intmbx' value set at the
> > last iteration is not used later in it's scope.
> >
> > Found by Linux Verification Center (linuxtesting.org) with SVACE.
> >
> > Fixes: 78f90dcf184b ("tg3: Move napi_add calls below tg3_get_invariants")
> > Signed-off-by: Mikhail Kobuk <m.kobuk@ispras.ru>
> > Reviewed-by: Alexey Khoroshilov <khoroshilov@ispras.ru>

Reviewed-by: Michael Chan <michael.chan@broadcom.com>

On Sun, Aug 27, 2023 at 10:29:37AM -0700, Michael Chan wrote:
> On Sun, Aug 27, 2023 at 9:51 AM Simon Horman <horms@kernel.org> wrote:
> >
> > On Fri, Aug 25, 2023 at 10:04:41PM +0300, Mikhail Kobuk wrote:
> >
> > + Matt Carlson <mcarlson@broadcom.com>
> 
> Matt Carlson is no longer working for Broadcom.

Thanks, got it.

> > > 'tp->irq_max' value is either 1 [L16336] or 5 [L16354], as indicated in
> > > tg3_get_invariants(). Therefore, 'i' can't exceed 4 in tg3_init_one()
> > > that makes (i <= 4) always true. Moreover, 'intmbx' value set at the
> > > last iteration is not used later in it's scope.
> > >
> > > Found by Linux Verification Center (linuxtesting.org) with SVACE.
> > >
> > > Fixes: 78f90dcf184b ("tg3: Move napi_add calls below tg3_get_invariants")
> > > Signed-off-by: Mikhail Kobuk <m.kobuk@ispras.ru>
> > > Reviewed-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
> 
> Reviewed-by: Michael Chan <michael.chan@broadcom.com>

On Fri, Aug 25, 2023 at 10:04:41PM +0300, Mikhail Kobuk wrote:
> 'tp->irq_max' value is either 1 [L16336] or 5 [L16354], as indicated in
> tg3_get_invariants(). Therefore, 'i' can't exceed 4 in tg3_init_one()
> that makes (i <= 4) always true. Moreover, 'intmbx' value set at the
> last iteration is not used later in it's scope.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: 78f90dcf184b ("tg3: Move napi_add calls below tg3_get_invariants")
> Signed-off-by: Mikhail Kobuk <m.kobuk@ispras.ru>
> Reviewed-by: Alexey Khoroshilov <khoroshilov@ispras.ru>

Reviewed-by: Simon Horman <horms@kernel.org>