[DPDK/ethdev Bug 2113] bnxt: multiple issues found with GCC analyzer

[bugzilla@dpdk.org]

https://bugs.dpdk.org/show_bug.cgi?id=2113

            Bug ID: 2113
           Summary: bnxt: multiple issues found with GCC analyzer
           Product: DPDK
           Version: 26.11
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Severity: major
          Priority: Normal
         Component: ethdev
          Assignee: dev@dpdk.org
          Reporter: stephen@networkplumber.org
  Target Milestone: ---

10. net/bnxt: double free in tfc_msg error path
Component: ethdev | Severity: major | Confidence: confirmed

tfc_msg_alloc_dma_buf() (drivers/net/bnxt/tf_core/v3/tfc_msg.c:151) frees
buf->va_addr at :160 when rte_mem_virt2iova() fails and leaves the pointer set.
Every caller then goes to cleanup: and calls tfc_msg_free_dma_buf() (:176),
freeing it again. Callers: tfc_msg_idx_tbl_alloc_set, tfc_msg_idx_tbl_set,
tfc_msg_idx_tbl_get, tfc_msg_tcam_alloc_set, tfc_msg_tcam_set.

11. net/bnxt: tfc_msg_idx_tbl_set() allocates the DMA buffer twice
Component: ethdev | Severity: normal | Confidence: confirmed

drivers/net/bnxt/tf_core/v3/tfc_msg.c:647 calls tfc_msg_alloc_dma_buf(&buf,
data_size) unconditionally, and :653 calls it again inside if (req.data_size >=
sizeof(req.dev_data)). The first buffer is overwritten and leaked on every
DMA-sized set.

12. net/bnxt: uninitialised rxcmp1 used in compressed CQE SSE Rx
Component: ethdev | Severity: major | Confidence: confirmed

crx_burst_vec_sse() declares __m128i rxcmp1[] at
drivers/net/bnxt/bnxt_rxtx_vec_sse.c:448 and passes it to crx_descs_to_mbufs()
(:498) without ever writing it. GET_DESC_FIELDS (:51) blends rxcmp1 into the
vlan_tci word of rx_descriptor_fields1, so every mbuf on this path gets stack
garbage in vlan_tci.

13. net/bnxt: leaks in bnxt_alloc_ctx_mem_blk() error paths
Component: ethdev | Severity: minor | Confidence: single pass

drivers/net/bnxt/bnxt_ethdev.c: ctx_pg_arr (:5043) leaks when the ctx_dma_arr
allocation fails (:5050), and ctx_dma_arr leaks when rte_memzone_reserve fails
(:5096). bnxt_free_ctx_mem() does not recover them because BNXT_CTX_FLAG_INITED
is not set.

14. net/bnxt: NULL check after dereference in bnxt_free_ctx_mem()
Component: ethdev | Severity: trivial | Confidence: confirmed

drivers/net/bnxt/bnxt_ethdev.c:5194-5196 dereferences bp->ctx->tqm_mem[i] twice
and then tests it for NULL. The check is dead or the dereference is wrong.

-- 
You are receiving this mail because:
You are the assignee for the bug.