[DPDK/ethdev Bug 2114] net/intel: multiple issues found by GCC analyzer

[bugzilla@dpdk.org]

https://bugs.dpdk.org/show_bug.cgi?id=2114

            Bug ID: 2114
           Summary: net/intel: multiple issues found by GCC analyzer
           Product: DPDK
           Version: 26.11
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Severity: major
          Priority: Normal
         Component: ethdev
          Assignee: dev@dpdk.org
          Reporter: stephen@networkplumber.org
  Target Milestone: ---

15. net/cpfl: cfgq leaked in vcpf_save_chunk_in_cfgq()
Component: ethdev | Severity: minor | Confidence: single pass

drivers/net/intel/cpfl/cpfl_ethdev.c:2201 allocates cfgq; :2210-2213 returns
-ENOMEM when the cfgq_add allocation fails without freeing it.

16. net/cpfl, net/idpf: adapter leaked on probe failure
Component: ethdev | Severity: minor | Confidence: single pass

cpfl_pci_probe_first() allocates adapter at
drivers/net/intel/cpfl/cpfl_ethdev.c:3096 and returns at :3106 (devargs parse)
and :3111 (adapter init) without freeing it. idpf_pci_probe() has the same
pattern: allocation at drivers/net/intel/idpf/idpf_ethdev.c:1666, return at
:1674.

17. net/cpfl: NULL dereference parsing a "parameter" content field without prog
action
Component: ethdev | Severity: normal | Confidence: single pass

cpfl_parse_content() (drivers/net/intel/cpfl/cpfl_flow_parser.c:1989) reads
prog->prog, which is only set at :1881 when the mod rule key has a PROG action.
The JSON loader accepts a content field of type "parameter" for any key, so
such a rule crashes when used.

18. net/cpfl: cpfl_repr_create() returns uninitialised value
Component: ethdev | Severity: normal | Confidence: confirmed

int ret; (drivers/net/intel/cpfl/cpfl_representor.c:563) is only assigned
inside the allowlist loop. If the hash is empty or every entry is skipped by if
(dev != NULL) continue;, the function returns garbage at :662 and the callers
may treat it as a probe failure.

19. net/ice: kb leaked in _xlt_kb_get()
Component: ethdev | Severity: minor | Confidence: single pass

drivers/net/intel/ice/base/ice_xlt_kb.c:135 allocates kb; :144-148 returns NULL
when ice_pkg_enum_section() finds no section, without freeing it.

20. net/ice: DCF VF representor VLAN ops dereference NULL after DCF release
Component: ethdev | Severity: normal | Confidence: confirmed

ice_dcf_vf_repr_hw() returns NULL when !repr->dcf_valid
(drivers/net/intel/ice/ice_dcf_vf_representor.c:135).
ice_dcf_vlan_offload_ena() (:233) dereferences the result unchecked. Reached
from the vlan_offload_set, vlan_pvid_set and vlan_tpid_set ops.

21. net/idpf: unchecked allocation in idpf_vc_queue_grps_del()
Component: ethdev | Severity: minor | Confidence: single pass

drivers/net/intel/idpf/idpf_common_virtchnl.c:439 rte_zmalloc() result is
dereferenced at :441.

22. net/ixgbe: uninitialised buffers copied in E610 ACI commands
Component: ethdev | Severity: trivial | Confidence: single pass

ixgbe_read_sr_word_aci() passes uninitialised data_local
(drivers/net/intel/ixgbe/base/ixgbe_e610.c:3162) as a response buffer that
ixgbe_aci_send_cmd_execute() copies out at :240. ixgbe_update_link_info()
passes an unzeroed malloc that is copied at :395. Also ixgbe_dev_mtu_set()
(ixgbe_ethdev.c:5322) passes an uninitialised dev_info to ixgbe_dev_info_get(),
which does dev_capa |= on it (:3922). No functional effect seen.

-- 
You are receiving this mail because:
You are the assignee for the bug.