|SUCCESS| [v2,7/7] net/ice: fix ACL profile segment leak

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: SUCCESS
https://dpdk.org/patch/172341

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-11-02

# Review of DPDK ice driver resource leak fixes

## ERRORS

None identified.

## WARNINGS

None identified.

## INFO

**Patch 1/7 - DDP package double free**
Clean fix. Replaces direct `ice_free()` with `ice_free_seg()` which clears the dangling pointers, preventing the double-free when `ice_deinit_hw()` is later called on the error path.

**Patch 2/7 - Resource leaks on port close**
Consolidates teardown into `ice_deinit_hw()` instead of open-coding a subset of it. This ensures the flow director counter block is returned to firmware and the switch filter structures are freed. The reduction from 5 cleanup calls to 1 makes the error path more maintainable.

**Patch 3/7 - DDP filename leak**
Fixes leak of `strdup()`'d devarg string on init failure and on duplicate devarg. The `free()` before storing a new value handles the duplicate case; the `err_free_devargs` label on all failure paths handles init errors.

**Patch 4/7 - Main VSI leak on init failure**
Adds `err_release_vsi` label to release the main VSI when `ice_send_driver_ver()` or subsequent operations fail. The VSI carries MAC filters and a firmware VSI context, so skipping its release leaked both memory and hardware state.

**Patch 5/7 - MAC and VLAN filter leak on VSI release**
`ice_remove_all_mac_vlan_filters()` can exit early, leaving entries in the filter lists. The patch adds a sweep with `RTE_TAILQ_FOREACH_SAFE` to free any remaining entries before the VSI itself is freed. The pattern is correct: iterate with a temp pointer, `rte_free()` each entry.

**Patch 6/7 - FDIR resource leak on setup failure**
Multiple error paths in `ice_fdir_setup()` returned directly without releasing the hash table, counter pools, or VSI. The patch adds labels `fail_counter` and `fail_filter_list` so all paths release what was allocated. This also unregisters the hash table name, allowing a subsequent setup attempt to succeed.

**Patch 7/7 - ACL profile segment leak**
Changes `ice_acl_prof_init()` to allocate the flow segment on the stack instead of the heap. Since `ice_flow_add_prof()` copies the segment, the allocation only needs to last for the function duration. Stack allocation removes the need for `ice_malloc()` / `ice_free()` and eliminates the leak on the success path.

All patches address genuine resource leaks (memory, hardware state, registered names) on error paths or in teardown. The fixes follow DPDK patterns (goto labels for unwinding, `RTE_TAILQ_FOREACH_SAFE` for list cleanup). No code was read outside the patches, so no claims are made about surrounding correctness.

Review-Result: CLEAN