[DPDK/ethdev Bug 2116] net/nfp: multiple issues detected with GCC 16 and -fanalyzer

[bugzilla@dpdk.org]

https://bugs.dpdk.org/show_bug.cgi?id=2116

            Bug ID: 2116
           Summary: net/nfp: multiple issues detected with GCC 16 and
                    -fanalyzer
           Product: DPDK
           Version: 26.11
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Severity: normal
          Priority: Normal
         Component: ethdev
          Assignee: dev@dpdk.org
          Reporter: stephen@networkplumber.org
  Target Milestone: ---

26. net/nfp: double free on malformed firmware ELF
Component: ethdev | Severity: major | Confidence: confirmed

nfp_elf_read_section_headers() frees ectx->shdrs_host_endian, shdrs_data and
shdrs on its error labels (drivers/net/nfp/nfpcore/nfp_elf.c:866-870) without
clearing them. nfp_elf_mutable_buf() then goes to elf_free: and nfp_elf_free()
(:275-277) frees the same pointers again.

27. net/nfp: txq leaked on NFDK Tx queue setup failure
Component: ethdev | Severity: minor | Confidence: single pass

nfp_net_nfdk_tx_queue_setup() allocates txq at
drivers/net/nfp/nfdk/nfp_nfdk_dp.c:460. On memzone (:476) or txbufs (:499)
failure it calls nfp_net_tx_queue_release(dev, queue_idx), which frees
dev->data->tx_queues[queue_idx]. That slot is only assigned at :513, so txq is
not freed.

28. net/nfp: hw_priv/pf_dev leaked when firmware reports no ports in secondary
Component: ethdev | Severity: minor | Confidence: single pass

nfp_pf_secondary_init() (drivers/net/nfp/nfp_ethdev.c:2847): when
nfp_net_get_phyports_from_fw() returns 0, the port loop does not run and the
function returns 0 without attaching or freeing its allocations.

29. net/nfp: unchecked allocation in nfp_nsp_command_buf_dma_sg()
Component: ethdev | Severity: minor | Confidence: single pass

drivers/net/nfp/nfpcore/nfp_nsp.c:551 rte_zmalloc() result is dereferenced at
:555.

30. net/nfp: rte_pktmbuf_prepend() not checked in NFD3 Tx metadata
Component: ethdev | Severity: normal | Confidence: confirmed

nfp_net_nfd3_set_meta_data() (drivers/net/nfp/nfd3/nfp_nfd3_dp.c:184) writes
through the result of rte_pktmbuf_prepend(pkt, meta_data->length) without a
NULL check. A Tx mbuf with VLAN or IPsec offload and too little headroom
crashes.

-- 
You are receiving this mail because:
You are the assignee for the bug.