[PATCH 0/2] net/txgbe: fix coverity issues

[PATCH 0/2] net/txgbe: fix coverity issues

[Zaiyu Wang]

This series fixes several Coverity issues reported against the txgbe
driver in the 26.07-rc2 release.

Patch 1 fixes a REVERSE_INULL issue (CID 504601) in
txgbe_dev_setup_link_alarm_handler_aml() by moving the null pointer
check before the pointer dereference.

Patch 2 fixes INTEGER_OVERFLOW (CID 504602) and BAD_SHIFT issues
(CIDs 504598, 504613) in the e56 backplane code by validating
lane_num at the source in txgbe_e56_cl72_training() before any
GENMASK operations are performed.

Zaiyu Wang (2):
  net/txgbe: fix null pointer check order
  net/txgbe: validate lane_num before GENMASK operations

 drivers/net/txgbe/base/txgbe_e56_bp.c | 6 +++++-
 drivers/net/txgbe/txgbe_ethdev.c      | 7 ++++---
 2 files changed, 9 insertions(+), 4 deletions(-)

-- 
2.21.0.windows.1

[PATCH 1/2] net/txgbe: fix null pointer check order

[Zaiyu Wang]

Move the null pointer check for 'hw' to the beginning of
txgbe_dev_setup_link_alarm_handler_aml() before any dereference
operation.

Currently, 'hw' is dereferenced via hw->dev_back before the
if (!hw) check. This is a reverse NULL check (REVERSE_INULL)
that renders the null pointer validation ineffective and
introduces undefined behavior.

This check serves as a defensive measure against two scenarios:
1. The function is called with a NULL parameter.
2. During application exit, rte_eth_dev_release_port() frees
   the port private data (dev_private) while an alarm callback
   is still pending or being executed. In such cases, checking
   'hw' early helps prevent access to already freed memory.

Coverity issue: 504601
Fixes: 6104fd11086e ("net/txgbe: fix link stability for 25G NIC")
Cc: stable@dpdk.org

Signed-off-by: Zaiyu Wang <zaiyuwang@trustnetic.com>
---
 drivers/net/txgbe/txgbe_ethdev.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/net/txgbe/txgbe_ethdev.c b/drivers/net/txgbe/txgbe_ethdev.c
index 9a1cb448ad..4d2746371b 100644
--- a/drivers/net/txgbe/txgbe_ethdev.c
+++ b/drivers/net/txgbe/txgbe_ethdev.c
@@ -3264,15 +3264,16 @@ void
 txgbe_dev_setup_link_alarm_handler_aml(void *param)
 {
 	struct txgbe_hw *hw = (struct txgbe_hw *)param;
+
+	if (!hw)
+		return;
+
 	struct rte_eth_dev *dev = (struct rte_eth_dev *)hw->dev_back;
 	struct txgbe_interrupt *intr = TXGBE_DEV_INTR(dev);
 	u32 speed;
 	bool autoneg = false;
 	u32 gssr = hw->phy.phy_semaphore_mask;
 
-	if (!hw)
-		return;
-
 	speed = hw->phy.autoneg_advertised;
 	if (!speed)
 		hw->mac.get_link_capabilities(hw, &speed, &autoneg);
-- 
2.21.0.windows.1

[PATCH 2/2] net/txgbe: validate lane_num before GENMASK operations

[Zaiyu Wang]

Coverity reports multiple issues (INTEGER_OVERFLOW and BAD_SHIFT)
in the e56 backplane code. The root cause is that 'lane_num' is
initialized to 0 and only set in the switch statement based on
the link speed. The default case simply logs and breaks, leaving
lane_num as 0 for unsupported speeds.

This leads to unsigned underflow when evaluating 'lane_num - 1'
in GENMASK(lane_num - 1, 0), and undefined behavior when the
resulting mask is used in shift operations.

Fix by returning -EINVAL immediately in the default case of
txgbe_e56_cl72_training(), preventing any invalid speed from
proceeding further. Also add error handling at the call site
txgbe_handle_e56_bkp_an73_flow() to check the return value and
propagate the error.

For txgbe_e56_rxs_osc_init_for_temp_track_range(), no additional
check is added because:
1. It is called from txgbe_e56_cl72_training() after lane_num
   has been validated to one of the legal values (1, 2, 4, or 8).
2. The other caller, txgbe_e56_set_phy_link_mode(), passes a
   fixed speed of 10 (lane_num = 1), which is also valid.

Coverity issue: 504598, 504602, 504613
Fixes: 234ce0d1fa9d ("net/txgbe: fix link stability for Amber-Lite backplane mode")
Cc: stable@dpdk.org

Signed-off-by: Zaiyu Wang <zaiyuwang@trustnetic.com>
---
 drivers/net/txgbe/base/txgbe_e56_bp.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/txgbe/base/txgbe_e56_bp.c b/drivers/net/txgbe/base/txgbe_e56_bp.c
index f8b39a0c7e..d376d918df 100644
--- a/drivers/net/txgbe/base/txgbe_e56_bp.c
+++ b/drivers/net/txgbe/base/txgbe_e56_bp.c
@@ -2432,7 +2432,7 @@ static int txgbe_e56_cl72_training(struct txgbe_hw *hw)
 		break;
 	default:
 		BP_LOG("%s %d :Invalid speed\n", __func__, __LINE__);
-		break;
+		return -EINVAL;
 	}
 
 	BP_LOG("2.3 Wait %dG KR phy mode init ....\n", bylinkmode);
@@ -2583,6 +2583,10 @@ int txgbe_handle_e56_bkp_an73_flow(struct txgbe_hw *hw)
 	}
 
 	status = txgbe_e56_cl72_training(hw);
+	if (status) {
+		BP_LOG("CL72 training failed, status = %d\n", status);
+		return status;
+	}
 
 	rdata = rd32_ephy(hw, E56PHY_RXS_IDLE_DETECT_1_ADDR);
 	set_fields_e56(&rdata, E56PHY_RXS_IDLE_DETECT_1_IDLE_TH_ADC_PEAK_MAX, 0x28);
-- 
2.21.0.windows.1

Re: [PATCH 0/2] net/txgbe: fix coverity issues

[Thomas Monjalon]

06/07/2026 12:47, Zaiyu Wang:
> This series fixes several Coverity issues reported against the txgbe
> driver in the 26.07-rc2 release.
> 
> Patch 1 fixes a REVERSE_INULL issue (CID 504601) in
> txgbe_dev_setup_link_alarm_handler_aml() by moving the null pointer
> check before the pointer dereference.
> 
> Patch 2 fixes INTEGER_OVERFLOW (CID 504602) and BAD_SHIFT issues
> (CIDs 504598, 504613) in the e56 backplane code by validating
> lane_num at the source in txgbe_e56_cl72_training() before any
> GENMASK operations are performed.
> 
> Zaiyu Wang (2):
>   net/txgbe: fix null pointer check order
>   net/txgbe: validate lane_num before GENMASK operations

Applied, thanks.