[DPDK/ethdev Bug 2117] net/cnxk: mulitple issues detected with GCC -fanalyzer

[bugzilla@dpdk.org]

https://bugs.dpdk.org/show_bug.cgi?id=2117

            Bug ID: 2117
           Summary: net/cnxk: mulitple issues detected with GCC -fanalyzer
           Product: DPDK
           Version: 26.11
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Severity: normal
          Priority: Normal
         Component: ethdev
          Assignee: dev@dpdk.org
          Reporter: stephen@networkplumber.org
  Target Milestone: ---

31. net/cnxk: process_ack_message() overwrites the buffer pointer it just
allocated
Component: ethdev | Severity: normal | Confidence: confirmed

drivers/net/cnxk/cnxk_rep_msg.c:338 sets adata->u.data = rte_zmalloc(...). For
msg_len == 8, :341 does rte_memcpy(&adata->u.data, buf, msg_len), overwriting
the pointer and leaking the allocation. For other sizes :343 copies into the
unchecked allocation.

32. net/cnxk: send_ack_message() never frees its buffer
Component: ethdev | Severity: normal | Confidence: confirmed

drivers/net/cnxk/cnxk_rep_msg.c:552 allocates buffer (CTRL_MSG_BUFFER_SZ). No
path frees it; the function ends at done: return rc; (:575).

33. net/cnxk: unchecked plt_zmalloc() in representor message and flow code
Component: ethdev | Severity: minor | Confidence: single pass

drivers/net/cnxk/cnxk_rep_msg.c:391, :419, :451, :613 and cnxk_rep_flow.c:213,
:223 use the plt_zmalloc() result without a NULL check. At cnxk_rep_msg.c:419
the new adata also replaces the one stored at :394, which is leaked.

34. net/cnxk: flow leaked in cnxk_eswitch_pfvf_flow_rules_install()
Component: ethdev | Severity: minor | Confidence: single pass

drivers/net/cnxk/cnxk_eswitch_flow.c:395 allocates flow. The goto free_flow
paths (:403-429) call cnxk_eswitch_flow_rules_remove_list(), which only frees
list members; flow is not on the list yet.

35. net/cnxk: msg leaked in cnxk_representee_notification()
Component: ethdev | Severity: minor | Confidence: single pass

drivers/net/cnxk/cnxk_rep.c:398 allocates msg; when the notify_msg allocation
fails (:406-409) it jumps to done without freeing msg.

36. net/cnxk: TM node and shaper profile leaked when roc add fails
Component: ethdev | Severity: normal | Confidence: single pass

cnxk_nix_tm_shaper_profile_add() (drivers/net/cnxk/cnxk_tm.c:306-312) and
cnxk_nix_tm_node_add() (:394-399) return on a roc error without freeing the
profile or node they allocated. Reachable with invalid user parameters.

-- 
You are receiving this mail because:
You are the assignee for the bug.