https://bugs.dpdk.org/show_bug.cgi?id=2113
Bug ID: 2113
Summary: bnxt: multiple issues found with GCC analyzer
Product: DPDK
Version: 26.11
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: major
Priority: Normal
Component: ethdev
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
10. net/bnxt: double free in tfc_msg error path
Component: ethdev | Severity: major | Confidence: confirmed
tfc_msg_alloc_dma_buf() (drivers/net/bnxt/tf_core/v3/tfc_msg.c:151) frees
buf->va_addr at :160 when rte_mem_virt2iova() fails and leaves the pointer set.
Every caller then goes to cleanup: and calls tfc_msg_free_dma_buf() (:176),
freeing it again. Callers: tfc_msg_idx_tbl_alloc_set, tfc_msg_idx_tbl_set,
tfc_msg_idx_tbl_get, tfc_msg_tcam_alloc_set, tfc_msg_tcam_set.
11. net/bnxt: tfc_msg_idx_tbl_set() allocates the DMA buffer twice
Component: ethdev | Severity: normal | Confidence: confirmed
drivers/net/bnxt/tf_core/v3/tfc_msg.c:647 calls tfc_msg_alloc_dma_buf(&buf,
data_size) unconditionally, and :653 calls it again inside if (req.data_size >=
sizeof(req.dev_data)). The first buffer is overwritten and leaked on every
DMA-sized set.
12. net/bnxt: uninitialised rxcmp1 used in compressed CQE SSE Rx
Component: ethdev | Severity: major | Confidence: confirmed
crx_burst_vec_sse() declares __m128i rxcmp1[] at
drivers/net/bnxt/bnxt_rxtx_vec_sse.c:448 and passes it to crx_descs_to_mbufs()
(:498) without ever writing it. GET_DESC_FIELDS (:51) blends rxcmp1 into the
vlan_tci word of rx_descriptor_fields1, so every mbuf on this path gets stack
garbage in vlan_tci.
13. net/bnxt: leaks in bnxt_alloc_ctx_mem_blk() error paths
Component: ethdev | Severity: minor | Confidence: single pass
drivers/net/bnxt/bnxt_ethdev.c: ctx_pg_arr (:5043) leaks when the ctx_dma_arr
allocation fails (:5050), and ctx_dma_arr leaks when rte_memzone_reserve fails
(:5096). bnxt_free_ctx_mem() does not recover them because BNXT_CTX_FLAG_INITED
is not set.
14. net/bnxt: NULL check after dereference in bnxt_free_ctx_mem()
Component: ethdev | Severity: trivial | Confidence: confirmed
drivers/net/bnxt/bnxt_ethdev.c:5194-5196 dereferences bp->ctx->tqm_mem[i] twice
and then tests it for NULL. The check is dead or the dereference is wrong.
--
You are receiving this mail because:
You are the assignee for the bug.
