|WARNING| [2/2] net/iavf: fix leak of queue to traffic class mapping data

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: WARNING
https://dpdk.org/patch/166501

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-07-03

# DPDK Patch Review

## Patch 1/2: net/iavf: fix local memory leaks in TM hierarchy commit

### Errors

None.

### Warnings

**Queue-related buffer allocation using `calloc()` instead of `rte_zmalloc_socket()`**

The `q_tc_mapping` and `q_bw` structures are queue configuration data that may need to be visible to secondary DPDK processes and should be NUMA-local. Using standard `calloc()` prevents:
1. Secondary process access (if this driver supports primary/secondary)
2. NUMA-local allocation for performance
3. Hugepage backing for shared memory visibility

Suggested fix:
```c
q_tc_mapping = rte_zmalloc_socket("q_tc", size, 0, socket_id);
/* ... */
q_bw = rte_zmalloc_socket("q_bw", size_q, 0, socket_id);
```

Then use `rte_free()` instead of `free()` for cleanup. The `socket_id` should be derived from `dev->data->numa_node` or the appropriate NUMA context.

Note: If these structures are truly local to this function and never accessed by secondary processes or DMA, then `calloc()` is acceptable. However, given that `qtc_map` in patch 2/2 is stored in the VF structure and accessed across the driver, these configuration structures likely have similar requirements.

---

## Patch 2/2: net/iavf: fix leak of queue to traffic class mapping data

### Errors

None.

### Warnings

**Inconsistent memory allocation API for `qtc_map`**

The `qtc_map` structure is stored in `vf->qtc_map` and persists beyond the function lifetime. If the driver supports DPDK primary/secondary process mode, this data should use `rte_zmalloc_socket()` to ensure:
1. Visibility to secondary processes
2. NUMA-local allocation
3. Proper cleanup with `rte_free()`

Current code uses `calloc()` (standard heap) while the rest of the VF structure fields use hugepage-backed memory.

Suggested fix:
```c
/* In iavf_hierarchy_commit() */
qtc_map = rte_zmalloc_socket("qtc_map",
    sizeof(struct iavf_qtc_map) * q_tc_mapping->num_tc, 0,
    dev->data->numa_node);

/* In cleanup paths */
rte_free(vf->qtc_map);
```

If primary/secondary support is not needed for this driver, document this assumption and keep `calloc()`/`free()` consistently.

---

## Summary

**Correctness:** Both patches correctly address resource leaks. Error paths properly release all allocated memory. No use-after-free, double-free, or NULL dereference issues detected.

**Allocation Strategy:** The choice between `calloc()`/`free()` and `rte_zmalloc()`/`rte_free()` should be consistent and based on whether:
- The data needs to be visible to secondary DPDK processes
- NUMA locality matters for performance
- The data is used by DMA or hardware

For queue configuration and mapping structures stored in the VF handle, `rte_zmalloc_socket()` is typically the safer choice unless the driver explicitly does not support secondary processes.

**Style:** Code follows DPDK conventions. NULL initialization of pointers before allocation is appropriate for error path cleanup.