[PATCH 0/4] Static analysis fixes

[PATCH 0/4] Static analysis fixes

[Kevin Traynor]

Fix some leaks and uninitialized variables.

Kevin Traynor (4):
  vhost: fix resource leak
  net/bnxt: fix uninitialized read
  app/testpmd: check for no arguments
  app/testpmd: fix fd leak

 app/test-pmd/cmdline.c               | 10 ++++++++--
 drivers/net/bnxt/tf_ulp/ulp_sc_mgr.c |  2 +-
 lib/vhost/socket.c                   |  1 +
 3 files changed, 10 insertions(+), 3 deletions(-)

-- 
2.53.0

[PATCH 1/4] vhost: fix resource leak

[Kevin Traynor]

When the return value check for pthread_mutex_init() was removed the
out_free label and vhost_user_socket_mem_free() were removed.

The free is still needed as vsocket was not being freed on out_mutex
error path.

Restore vhost_user_socket_mem_free() on error path.

Fixes: 4d2aa150769b ("vhost: remove check around mutex init")
Cc: stable@dpdk.org

Signed-off-by: Kevin Traynor <ktraynor@redhat.com>
---
 lib/vhost/socket.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/vhost/socket.c b/lib/vhost/socket.c
index ae95e7e6b0..278a2c01d8 100644
--- a/lib/vhost/socket.c
+++ b/lib/vhost/socket.c
@@ -1037,4 +1037,5 @@ rte_vhost_driver_register(const char *path, uint64_t flags)
 		VHOST_CONFIG_LOG(path, ERR, "failed to destroy connection mutex");
 	}
+	vhost_user_socket_mem_free(vsocket);
 out:
 	pthread_mutex_unlock(&vhost_user.mutex);
-- 
2.53.0

[PATCH 2/4] net/bnxt: fix uninitialized read

[Kevin Traynor]

batch_info->enabled is read in tfc_mpc_batch_start() before it is
initialized.

Initialize batch_info to avoid this.

Fixes: 67ad40007cd6 ("net/bnxt/tf_ulp: fix VFR cleanup and stats lockup")
Cc: stable@dpdk.org

Signed-off-by: Kevin Traynor <ktraynor@redhat.com>
---
 drivers/net/bnxt/tf_ulp/ulp_sc_mgr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/bnxt/tf_ulp/ulp_sc_mgr.c b/drivers/net/bnxt/tf_ulp/ulp_sc_mgr.c
index b55366e003..23e1b59ca4 100644
--- a/drivers/net/bnxt/tf_ulp/ulp_sc_mgr.c
+++ b/drivers/net/bnxt/tf_ulp/ulp_sc_mgr.c
@@ -193,5 +193,5 @@ static uint32_t ulp_stats_cache_main_loop(void *arg)
 	struct ulp_sc_tfc_stats_cache_entry *sce;
 	struct ulp_sc_tfc_stats_cache_entry *sce_end;
-	struct tfc_mpc_batch_info_t batch_info;
+	struct tfc_mpc_batch_info_t batch_info = {0};
 	struct bnxt_ulp_sc_info *ulp_sc_info;
 	struct bnxt_ulp_context *ctxt = NULL;
-- 
2.53.0

[PATCH 3/4] app/testpmd: check for no arguments

[Kevin Traynor]

For the case where token is NULL, there are no arguments
and split_str[0] is used uninitialized.

Check counter to ensure there is a token and return error if not.

Fixes: 601576ae6699 ("app/testpmd: add prio-tc map in DCB command")
Cc: stable@dpdk.org

Signed-off-by: Kevin Traynor <ktraynor@redhat.com>
---
 app/test-pmd/cmdline.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/app/test-pmd/cmdline.c b/app/test-pmd/cmdline.c
index c33c66f327..ab85f4e0ad 100644
--- a/app/test-pmd/cmdline.c
+++ b/app/test-pmd/cmdline.c
@@ -3570,4 +3570,9 @@ parse_dcb_token_value(char *token_str,
 	} while (1);
 
+	if (split_num == 0) {
+		fprintf(stderr, "Bad Argument: no arguments provided\n");
+		return -1;
+	}
+
 	/* parse fixed parameter "pfc-en" first. */
 	token = split_str[0];
-- 
2.53.0

[PATCH 4/4] app/testpmd: fix fd leak

[Kevin Traynor]

In error cases, the fd was not being closed.

Add label for error case that will close the fd.

Fixes: 1303b50a9c21 ("app/testpmd: add commands to dump mbuf history")
Cc: stable@dpdk.org

Signed-off-by: Kevin Traynor <ktraynor@redhat.com>
---
 app/test-pmd/cmdline.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/app/test-pmd/cmdline.c b/app/test-pmd/cmdline.c
index ab85f4e0ad..365f780aac 100644
--- a/app/test-pmd/cmdline.c
+++ b/app/test-pmd/cmdline.c
@@ -9359,5 +9359,5 @@ static void cmd_dump_mbuf_history_parsed(void *parsed_result,
 					"Failed to find mempool '%s'\n",
 					res->name);
-			return;
+			goto out_close;
 		}
 		rte_mbuf_history_dump_mempool(out, mp);
@@ -9372,5 +9372,5 @@ static void cmd_dump_mbuf_history_parsed(void *parsed_result,
 			cmdline_printf(cl,
 					"Invalid mbuf pointer format. Use 0x<address>\n");
-			return;
+			goto out_close;
 		}
 		mbuf = (struct rte_mbuf *)mbuf_addr;
@@ -9382,4 +9382,5 @@ static void cmd_dump_mbuf_history_parsed(void *parsed_result,
 	}
 
+out_close:
 	if (out != stdout)
 		fclose(out);
-- 
2.53.0

Re: [PATCH 3/4] app/testpmd: check for no arguments

[fengchengwen]

Hi Kevin,

On 3/12/2026 6:36 PM, Kevin Traynor wrote:
> For the case where token is NULL, there are no arguments
> and split_str[0] is used uninitialized.

In which case the token is NULL, if there are no arguments, the cmdline's
callback won't be invoke.

Thanks

> 
> Check counter to ensure there is a token and return error if not.
> 
> Fixes: 601576ae6699 ("app/testpmd: add prio-tc map in DCB command")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Kevin Traynor <ktraynor@redhat.com>
> ---
>  app/test-pmd/cmdline.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/app/test-pmd/cmdline.c b/app/test-pmd/cmdline.c
> index c33c66f327..ab85f4e0ad 100644
> --- a/app/test-pmd/cmdline.c
> +++ b/app/test-pmd/cmdline.c
> @@ -3570,4 +3570,9 @@ parse_dcb_token_value(char *token_str,
>  	} while (1);
>  
> +	if (split_num == 0) {
> +		fprintf(stderr, "Bad Argument: no arguments provided\n");
> +		return -1;
> +	}
> +
>  	/* parse fixed parameter "pfc-en" first. */
>  	token = split_str[0];

Re: [PATCH 2/4] net/bnxt: fix uninitialized read

[Stephen Hemminger]

On Thu, 12 Mar 2026 10:36:04 +0000
Kevin Traynor <ktraynor@redhat.com> wrote:

> batch_info->enabled is read in tfc_mpc_batch_start() before it is
> initialized.
> 
> Initialize batch_info to avoid this.
> 
> Fixes: 67ad40007cd6 ("net/bnxt/tf_ulp: fix VFR cleanup and stats lockup")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Kevin Traynor <ktraynor@redhat.com>

This needs to go through next-net-brcm so will delegate it.

Re: [PATCH 3/4] app/testpmd: check for no arguments

[Stephen Hemminger]

On Thu, 12 Mar 2026 20:37:42 +0800
fengchengwen <fengchengwen@huawei.com> wrote:

> Hi Kevin,
> 
> On 3/12/2026 6:36 PM, Kevin Traynor wrote:
> > For the case where token is NULL, there are no arguments
> > and split_str[0] is used uninitialized.  
> 
> In which case the token is NULL, if there are no arguments, the cmdline's
> callback won't be invoke.
> 
> Thanks

It still maybe possible to get there with an empty string ""
which would evaluate to no arguments?

Re: [PATCH 2/4] net/bnxt: fix uninitialized read

[Kishore Padmanabha]

[-- Attachment #1.1: Type: text/plain, Size: 1186 bytes --]

On Thu, Mar 12, 2026 at 6:36 AM Kevin Traynor <ktraynor@redhat.com> wrote:

> batch_info->enabled is read in tfc_mpc_batch_start() before it is
> initialized.
>
> Initialize batch_info to avoid this.
>
> Fixes: 67ad40007cd6 ("net/bnxt/tf_ulp: fix VFR cleanup and stats lockup")
> Cc: stable@dpdk.org
>
> Signed-off-by: Kevin Traynor <ktraynor@redhat.com>
> ---
>
Acked-by:  Kishore Padmanabha <kishore.padmanabha@broadcom.com>

>  drivers/net/bnxt/tf_ulp/ulp_sc_mgr.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/bnxt/tf_ulp/ulp_sc_mgr.c
> b/drivers/net/bnxt/tf_ulp/ulp_sc_mgr.c
> index b55366e003..23e1b59ca4 100644
> --- a/drivers/net/bnxt/tf_ulp/ulp_sc_mgr.c
> +++ b/drivers/net/bnxt/tf_ulp/ulp_sc_mgr.c
> @@ -193,5 +193,5 @@ static uint32_t ulp_stats_cache_main_loop(void *arg)
>         struct ulp_sc_tfc_stats_cache_entry *sce;
>         struct ulp_sc_tfc_stats_cache_entry *sce_end;
> -       struct tfc_mpc_batch_info_t batch_info;
> +       struct tfc_mpc_batch_info_t batch_info = {0};
>         struct bnxt_ulp_sc_info *ulp_sc_info;
>         struct bnxt_ulp_context *ctxt = NULL;
> --
> 2.53.0
>
>

[-- Attachment #1.2: Type: text/html, Size: 1920 bytes --]

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5493 bytes --]

Re: [PATCH 3/4] app/testpmd: check for no arguments

[fengchengwen]

On 3/13/2026 1:03 AM, Stephen Hemminger wrote:
> On Thu, 12 Mar 2026 20:37:42 +0800
> fengchengwen <fengchengwen@huawei.com> wrote:
> 
>> Hi Kevin,
>>
>> On 3/12/2026 6:36 PM, Kevin Traynor wrote:
>>> For the case where token is NULL, there are no arguments
>>> and split_str[0] is used uninitialized.  
>>
>> In which case the token is NULL, if there are no arguments, the cmdline's
>> callback won't be invoke.
>>
>> Thanks
> 
> It still maybe possible to get there with an empty string ""
> which would evaluate to no arguments?

No, as tested below:

testpmd> port config  dcb vt on 4 pfc ""
Bad arguments
testpmd> port config  dcb vt on 4 pfc ''
Bad arguments
testpmd> port config  dcb vt on 4 pfc '
Bad arguments
testpmd> port config  dcb vt on 4 pfc
Bad arguments

Re: [PATCH 3/4] app/testpmd: check for no arguments

[Kevin Traynor]

On 3/12/26 11:59 PM, fengchengwen wrote:
> On 3/13/2026 1:03 AM, Stephen Hemminger wrote:
>> On Thu, 12 Mar 2026 20:37:42 +0800
>> fengchengwen <fengchengwen@huawei.com> wrote:
>>
>>> Hi Kevin,
>>>
>>> On 3/12/2026 6:36 PM, Kevin Traynor wrote:
>>>> For the case where token is NULL, there are no arguments
>>>> and split_str[0] is used uninitialized.  
>>>
>>> In which case the token is NULL, if there are no arguments, the cmdline's
>>> callback won't be invoke.
>>>
>>> Thanks
>>
>> It still maybe possible to get there with an empty string ""
>> which would evaluate to no arguments?
> 
> No, as tested below:
> 
> testpmd> port config  dcb vt on 4 pfc ""
> Bad arguments
> testpmd> port config  dcb vt on 4 pfc ''
> Bad arguments
> testpmd> port config  dcb vt on 4 pfc '
> Bad arguments
> testpmd> port config  dcb vt on 4 pfc
> Bad arguments
> 
> 

Ok, no problem to drop the patch if not needed. static analysis was just
looking at the function as an independent unit.

Re: [PATCH 3/4] app/testpmd: check for no arguments

[fengchengwen]

On 3/13/2026 5:24 PM, Kevin Traynor wrote:
> On 3/12/26 11:59 PM, fengchengwen wrote:
>> On 3/13/2026 1:03 AM, Stephen Hemminger wrote:
>>> On Thu, 12 Mar 2026 20:37:42 +0800
>>> fengchengwen <fengchengwen@huawei.com> wrote:
>>>
>>>> Hi Kevin,
>>>>
>>>> On 3/12/2026 6:36 PM, Kevin Traynor wrote:
>>>>> For the case where token is NULL, there are no arguments
>>>>> and split_str[0] is used uninitialized.  
>>>>
>>>> In which case the token is NULL, if there are no arguments, the cmdline's
>>>> callback won't be invoke.
>>>>
>>>> Thanks
>>>
>>> It still maybe possible to get there with an empty string ""
>>> which would evaluate to no arguments?
>>
>> No, as tested below:
>>
>> testpmd> port config  dcb vt on 4 pfc ""
>> Bad arguments
>> testpmd> port config  dcb vt on 4 pfc ''
>> Bad arguments
>> testpmd> port config  dcb vt on 4 pfc '
>> Bad arguments
>> testpmd> port config  dcb vt on 4 pfc
>> Bad arguments
>>
>>
> 
> Ok, no problem to drop the patch if not needed. static analysis was just
> looking at the function as an independent unit.

May I ask what this static analysis tool is?

> 
> 

Re: [PATCH 3/4] app/testpmd: check for no arguments

[Kevin Traynor]

On 3/14/26 7:57 AM, fengchengwen wrote:
> On 3/13/2026 5:24 PM, Kevin Traynor wrote:
>> On 3/12/26 11:59 PM, fengchengwen wrote:
>>> On 3/13/2026 1:03 AM, Stephen Hemminger wrote:
>>>> On Thu, 12 Mar 2026 20:37:42 +0800
>>>> fengchengwen <fengchengwen@huawei.com> wrote:
>>>>
>>>>> Hi Kevin,
>>>>>
>>>>> On 3/12/2026 6:36 PM, Kevin Traynor wrote:
>>>>>> For the case where token is NULL, there are no arguments
>>>>>> and split_str[0] is used uninitialized.  
>>>>>
>>>>> In which case the token is NULL, if there are no arguments, the cmdline's
>>>>> callback won't be invoke.
>>>>>
>>>>> Thanks
>>>>
>>>> It still maybe possible to get there with an empty string ""
>>>> which would evaluate to no arguments?
>>>
>>> No, as tested below:
>>>
>>> testpmd> port config  dcb vt on 4 pfc ""
>>> Bad arguments
>>> testpmd> port config  dcb vt on 4 pfc ''
>>> Bad arguments
>>> testpmd> port config  dcb vt on 4 pfc '
>>> Bad arguments
>>> testpmd> port config  dcb vt on 4 pfc
>>> Bad arguments
>>>
>>>
>>
>> Ok, no problem to drop the patch if not needed. static analysis was just
>> looking at the function as an independent unit.
> 
> May I ask what this static analysis tool is?
> 

OpenScanHub which runs on rpms

>>
>>
> 

Re: [PATCH 2/4] net/bnxt: fix uninitialized read

[Thomas Monjalon]

12/03/2026 17:57, Stephen Hemminger:
> On Thu, 12 Mar 2026 10:36:04 +0000
> Kevin Traynor <ktraynor@redhat.com> wrote:
> 
> > batch_info->enabled is read in tfc_mpc_batch_start() before it is
> > initialized.
> > 
> > Initialize batch_info to avoid this.
> > 
> > Fixes: 67ad40007cd6 ("net/bnxt/tf_ulp: fix VFR cleanup and stats lockup")
> > Cc: stable@dpdk.org
> > 
> > Signed-off-by: Kevin Traynor <ktraynor@redhat.com>
> 
> This needs to go through next-net-brcm so will delegate it.

Please avoid breaking series, it makes tracking confusing.
The whole series can go in next-net.

Re: [PATCH 1/4] vhost: fix resource leak

[Maxime Coquelin]

Hi Kevin,

On Thu, Mar 12, 2026 at 11:36 AM Kevin Traynor <ktraynor@redhat.com> wrote:
>
> When the return value check for pthread_mutex_init() was removed the
> out_free label and vhost_user_socket_mem_free() were removed.
>
> The free is still needed as vsocket was not being freed on out_mutex
> error path.
>
> Restore vhost_user_socket_mem_free() on error path.
>
> Fixes: 4d2aa150769b ("vhost: remove check around mutex init")
> Cc: stable@dpdk.org
>
> Signed-off-by: Kevin Traynor <ktraynor@redhat.com>
> ---
>  lib/vhost/socket.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/lib/vhost/socket.c b/lib/vhost/socket.c
> index ae95e7e6b0..278a2c01d8 100644
> --- a/lib/vhost/socket.c
> +++ b/lib/vhost/socket.c
> @@ -1037,4 +1037,5 @@ rte_vhost_driver_register(const char *path, uint64_t flags)
>                 VHOST_CONFIG_LOG(path, ERR, "failed to destroy connection mutex");
>         }
> +       vhost_user_socket_mem_free(vsocket);
>  out:
>         pthread_mutex_unlock(&vhost_user.mutex);
> --
> 2.53.0
>

Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>

Thanks,
Maxime

Re: [PATCH 4/4] app/testpmd: fix fd leak

[Thomas Monjalon]

12/03/2026 11:36, Kevin Traynor:
> In error cases, the fd was not being closed.
> 
> Add label for error case that will close the fd.
> 
> Fixes: 1303b50a9c21 ("app/testpmd: add commands to dump mbuf history")

My bad

> Cc: stable@dpdk.org
> 
> Signed-off-by: Kevin Traynor <ktraynor@redhat.com>

Reviewed-by: Thomas Monjalon <thomas@monjalon.net>

Re: [PATCH 0/4] Static analysis fixes

[Thomas Monjalon]

12/03/2026 11:36, Kevin Traynor:
> Fix some leaks and uninitialized variables.
> 
> Kevin Traynor (4):
>   vhost: fix resource leak
>   net/bnxt: fix uninitialized read
>   app/testpmd: check for no arguments
>   app/testpmd: fix fd leak

Looks like the patch 3 is rejected.
Patches 1, 2 and 4 applied, thanks.