|WARNING| lpm: fix tbl8 reuse after delete all with RCU defer queue

dpdklab at iol.unh.edu dpdklab at iol.unh.edu
Mon Nov 9 08:48:24 CET 2026


Test-Label: ai-code-review
Test-Status: WARNING
https://dpdk.org/patch/172737

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-11-09

# DPDK Patch Review

## ERRORS

### 1. Missing barrier before clearing tbl8 groups

**File:** `lib/lpm/rte_lpm.c`, function `rte_lpm_delete_all()`

The patch clears all tbl8 groups and then synchronizes RCU readers. However, the tbl8 clearing must be visible to readers before the synchronization point. Without a release barrier, the compiler or CPU could reorder the writes, allowing readers to see stale tbl8 entries after the synchronization completes.

**Line:** `memset(i_lpm->rules_tbl, 0, sizeof(i_lpm->rules_tbl[0]) * i_lpm->max_rules);`

The memset clears the rules table but the tbl8 clearing happens elsewhere (likely in the loop above, not shown in the patch). Between the tbl8/rules clearing and the `rte_rcu_qsbr_synchronize()` call, there must be a release barrier to ensure the clearing is visible to all readers.

**Suggested fix:**
```c
/* Delete all rules from the rules table. */
memset(i_lpm->rules_tbl, 0, sizeof(i_lpm->rules_tbl[0]) * i_lpm->max_rules);

/*
 * The tbl8 groups waiting in the defer queue have just been
 * cleared and may be allocated again. Reclaim them now, otherwise
 * the deferred reclamation would invalidate a reused group.
 */
if (i_lpm->dq != NULL) {
	rte_atomic_thread_fence(rte_memory_order_release);
	rte_rcu_qsbr_synchronize(i_lpm->v, RTE_QSBR_THRID_INVALID);
	rte_rcu_qsbr_dq_reclaim(i_lpm->dq, i_lpm->number_tbl8s,
		NULL, NULL, NULL);
}
```

---

## WARNINGS

### 1. Missing release notes entry

The patch fixes a correctness bug (use-after-free of tbl8 groups) that affects the LPM library's RCU defer queue mode. This is a significant behavioral fix that should be documented in the release notes.

**Action required:** Add an entry to `doc/guides/rel_notes/release_<version>.rst` under the "Fixed Issues" section describing this tbl8 reuse bug fix.

---

## INFO

### 1. Test coverage is good

The new test case (test22) properly exercises the bug scenario:
1. Creates a tbl8 group and pushes it to the defer queue
2. Calls `delete_all` which should reclaim deferred groups
3. Verifies that the group can be safely reused without interference from deferred reclamation

This test directly validates the fix and would catch regressions.

---

Review-Result: ERROR


More information about the test-report mailing list