|WARNING| net/iavf: fix memory leaks in RSS flow engine

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: WARNING
https://dpdk.org/patch/170997

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-10-10

# DPDK Patch Review

## ERRORS

### 1. rte_free() on rte_zmalloc()'d memory without rte_free_sensitive()

**File:** drivers/net/intel/iavf/iavf_hash.c  
**Lines:** +1602, +1618, +1649

This code allocates and frees potentially sensitive RSS flow configuration data without zeroing it first. While RSS keys themselves are typically in a separate structure, the virtchnl_rss_cfg may contain pattern data or configuration details that should be cleared.

```c
rte_free(rss_cfg);
rte_free(meta);
```

**Suggested fix:**
If these structures contain no secrets (keys, authentication data), the current code is acceptable. However, if they do contain or reference sensitive material, use:

```c
rte_free_sensitive(rss_cfg, sizeof(*rss_cfg));
rte_free_sensitive(meta, sizeof(*meta));
```

**Severity justification:** Treating this as a **potential** correctness issue. RSS metadata structures *may* contain hash keys or other configuration that should not remain in freed memory. Without seeing the structure definitions, I cannot confirm whether secrets are present, but the context (RSS/hash engine) suggests they might be. If the structures provably contain no secrets, this finding should be downgraded to Info or removed.

---

## WARNINGS

### 1. Missing Cc: stable at dpdk.org

The patch fixes three bugs across three different commits (bc0e85586eaf, 7be10c3004be, c02ea7410e51) but does not include `Cc: stable at dpdk.org` in the commit message. Memory leaks and incorrect error reporting are backport candidates.

**Suggested fix:**  
Add to commit message body:
```
Cc: stable at dpdk.org
```

### 2. Release notes not updated

This patch fixes multiple memory leaks and an error reporting bug. These are significant correctness fixes that should be documented in the current release notes under a "Fixed Issues" or "Bugfixes" section for the iavf PMD.

**Suggested fix:**  
Update `doc/guides/rel_notes/release_26_11.rst` (or the appropriate current release file) with an entry such as:

```rst
* **net/iavf: Fixed memory leaks in RSS flow engine.**

  Fixed multiple resource leaks in the RSS (hash) flow creation,
  destruction, and raw pattern parsing paths.
```

---

## INFO

### 1. Error path cleanup pattern could be more robust

**File:** drivers/net/intel/iavf/iavf_hash.c  
**Lines:** 1596-1622

The current fix correctly adds `rte_free(meta)` to both error paths, but the pattern could be made more maintainable using a goto-based cleanup:

```c
	rss_cfg = rte_zmalloc("iavf rss rule",
			      sizeof(struct virtchnl_rss_cfg), 0);
	if (!rss_cfg) {
		rte_flow_error_set(error, ENOMEM,
				   RTE_FLOW_ERROR_TYPE_HANDLE, NULL,
				   "No memory for rss rule");
		ret = -ENOMEM;
		goto free_meta;
	}

	rss_cfg->proto_hdrs = meta->proto_hdrs;
	rss_cfg->rss_algorithm = meta->rss_algorithm;
	adapter->rss_cfg = rss_cfg;

	ret = iavf_add_del_rss_cfg(ad, rss_cfg, true);
	if (ret) {
		rte_flow_error_set(error, -ret,
				   RTE_FLOW_ERROR_TYPE_HANDLE, NULL,
				   "Failed to add rss rule.");
		goto free_rss_cfg;
	}

	flow->rule = rss_cfg;
	rte_free(meta);
	return 0;

free_rss_cfg:
	rte_free(rss_cfg);
free_meta:
	rte_free(meta);
	return ret;
```

This is a style suggestion for maintainability, not a correctness issue. The patch as written is correct.

---

## SUMMARY

The patch correctly fixes four distinct bugs:
1.  Missing `rte_free(pkt_buf)` on msk_buf allocation failure
2.  Missing `rte_free(meta)` on both error paths in iavf_hash_create()
3.  Missing `rte_free(rss_cfg)` and `flow->rule = NULL` in iavf_hash_destroy()
4.  Incorrect EINVAL - ENOMEM error reporting

All code changes are correct. The warnings concern missing process requirements (stable tag, release notes) rather than code defects.

Review-Result: WARNING