https://bugs.dpdk.org/show_bug.cgi?id=2117
Bug ID: 2117
Summary: net/cnxk: mulitple issues detected with GCC -fanalyzer
Product: DPDK
Version: 26.11
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: Normal
Component: ethdev
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
31. net/cnxk: process_ack_message() overwrites the buffer pointer it just
allocated
Component: ethdev | Severity: normal | Confidence: confirmed
drivers/net/cnxk/cnxk_rep_msg.c:338 sets adata->u.data = rte_zmalloc(...). For
msg_len == 8, :341 does rte_memcpy(&adata->u.data, buf, msg_len), overwriting
the pointer and leaking the allocation. For other sizes :343 copies into the
unchecked allocation.
32. net/cnxk: send_ack_message() never frees its buffer
Component: ethdev | Severity: normal | Confidence: confirmed
drivers/net/cnxk/cnxk_rep_msg.c:552 allocates buffer (CTRL_MSG_BUFFER_SZ). No
path frees it; the function ends at done: return rc; (:575).
33. net/cnxk: unchecked plt_zmalloc() in representor message and flow code
Component: ethdev | Severity: minor | Confidence: single pass
drivers/net/cnxk/cnxk_rep_msg.c:391, :419, :451, :613 and cnxk_rep_flow.c:213,
:223 use the plt_zmalloc() result without a NULL check. At cnxk_rep_msg.c:419
the new adata also replaces the one stored at :394, which is leaked.
34. net/cnxk: flow leaked in cnxk_eswitch_pfvf_flow_rules_install()
Component: ethdev | Severity: minor | Confidence: single pass
drivers/net/cnxk/cnxk_eswitch_flow.c:395 allocates flow. The goto free_flow
paths (:403-429) call cnxk_eswitch_flow_rules_remove_list(), which only frees
list members; flow is not on the list yet.
35. net/cnxk: msg leaked in cnxk_representee_notification()
Component: ethdev | Severity: minor | Confidence: single pass
drivers/net/cnxk/cnxk_rep.c:398 allocates msg; when the notify_msg allocation
fails (:406-409) it jumps to done without freeing msg.
36. net/cnxk: TM node and shaper profile leaked when roc add fails
Component: ethdev | Severity: normal | Confidence: single pass
cnxk_nix_tm_shaper_profile_add() (drivers/net/cnxk/cnxk_tm.c:306-312) and
cnxk_nix_tm_node_add() (:394-399) return on a roc error without freeing the
profile or node they allocated. Reachable with invalid user parameters.
--
You are receiving this mail because:
You are the assignee for the bug.
