net/intel: multiple issues found by GCC analyzer

https://bugs.dpdk.org/show_bug.cgi?id=2114

            Bug ID: 2114
           Summary: net/intel: multiple issues found by GCC analyzer
           Product: DPDK
           Version: 26.11
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Severity: major
          Priority: Normal
         Component: ethdev
          Assignee: [email protected]
          Reporter: [email protected]

Target Milestone: ---

15. net/cpfl: cfgq leaked in vcpf_save_chunk_in_cfgq()
Component: ethdev | Severity: minor | Confidence: single pass

drivers/net/intel/cpfl/cpfl_ethdev.c:2201 allocates cfgq; :2210-2213 returns -ENOMEM when the cfgq_add allocation fails without freeing it.

16. net/cpfl, net/idpf: adapter leaked on probe failure
Component: ethdev | Severity: minor | Confidence: single pass

cpfl_pci_probe_first() allocates adapter at drivers/net/intel/cpfl/cpfl_ethdev.c:3096 and returns at :3106 (devargs parse) and :3111 (adapter init) without freeing it. idpf_pci_probe() has the same
pattern: allocation at drivers/net/intel/idpf/idpf_ethdev.c:1666, return at :1674.

17. net/cpfl: NULL dereference parsing a "parameter" content field without prog action
Component: ethdev | Severity: normal | Confidence: single pass

cpfl_parse_content() (drivers/net/intel/cpfl/cpfl_flow_parser.c:1989) reads prog->prog, which is only set at :1881 when the mod rule key has a PROG action. The JSON loader accepts a content field of type "parameter" for any key, so such a rule crashes when used.

18. net/cpfl: cpfl_repr_create() returns uninitialised value
Component: ethdev | Severity: normal | Confidence: confirmed

int ret; (drivers/net/intel/cpfl/cpfl_representor.c:563) is only assigned inside the allowlist loop. If the hash is empty or every entry is skipped by if (dev != NULL) continue;, the function returns garbage at :662 and the callers may treat it as a probe failure.

19. net/ice: kb leaked in _xlt_kb_get()
Component: ethdev | Severity: minor | Confidence: single pass

drivers/net/intel/ice/base/ice_xlt_kb.c:135 allocates kb; :144-148 returns NULL when ice_pkg_enum_section() finds no section, without freeing it.

20. net/ice: DCF VF representor VLAN ops dereference NULL after DCF release
Component: ethdev | Severity: normal | Confidence: confirmed

ice_dcf_vf_repr_hw() returns NULL when !repr->dcf_valid (drivers/net/intel/ice/ice_dcf_vf_representor.c:135). ice_dcf_vlan_offload_ena() (:233) dereferences the result unchecked. Reached from the vlan_offload_set, vlan_pvid_set and vlan_tpid_set ops.

21. net/idpf: unchecked allocation in idpf_vc_queue_grps_del()
Component: ethdev | Severity: minor | Confidence: single pass

drivers/net/intel/idpf/idpf_common_virtchnl.c:439 rte_zmalloc() result is dereferenced at :441.

22. net/ixgbe: uninitialised buffers copied in E610 ACI commands
Component: ethdev | Severity: trivial | Confidence: single pass

ixgbe_read_sr_word_aci() passes uninitialised data_local (drivers/net/intel/ixgbe/base/ixgbe_e610.c:3162) as a response buffer that ixgbe_aci_send_cmd_execute() copies out at :240. ixgbe_update_link_info() passes an unzeroed malloc that is copied at :395. Also ixgbe_dev_mtu_set() (ixgbe_ethdev.c:5322) passes an uninitialised dev_info to ixgbe_dev_info_get(), which does dev_capa |= on it (:3922). No functional effect seen.

You are receiving this mail because:
You are the assignee for the bug.