|SUCCESS| [v2, 3/3] net/iavf: fix crash in TM ops without QoS capability

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: SUCCESS
https://dpdk.org/patch/171774

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-10-20

I will review these three patches against the DPDK contribution guidelines.

## PATCH 1/3: net/iavf: fix invalid free of queue TC map

### Errors

None.

### Warnings

None.

### Info

This patch correctly identifies and fixes a double-free bug. The analysis is sound:
- `calloc()` allocates from the libc heap
- `rte_free()` expects hugepage-backed memory from `rte_malloc()`
- Calling `rte_free()` on libc heap memory is a mismatched allocator bug
- The subsequent `free(old_qtc_map)` would then be a double-free of the same pointer

The fix correctly removes both inappropriate `rte_free()` calls and relies on the existing `free()` calls that match the `calloc()` allocations.

---

## PATCH 2/3: net/iavf: fix bandwidth config of unshaped queues

### Errors

None.

### Warnings

None.

### Info

This patch fixes a logic error where unshaped queues were not properly configured due to missing field initialization. The fix correctly initializes `queue_id` and `tc` for all queue nodes regardless of whether they have an active shaper profile, ensuring the PF receives valid configuration for unshaped queues to restore their default bandwidth.

The change is minimal and correct: moving the two assignments outside the `if (tm_node->shaper_profile)` conditional ensures all entries are properly initialized.

---

## PATCH 3/3: net/iavf: fix crash in TM ops without QoS capability

### Errors

None.

### Warnings

None.

### Info

This patch fixes a NULL pointer dereference when TM operations are called on a VF that does not have the QoS capability granted by the PF.

The fix introduces a helper function `iavf_tm_qos_check()` that validates `vf->qos_cap != NULL` before operations that would dereference it. The error handling is appropriate:
- Returns `-ENOTSUP` (operation not supported)
- Sets proper error type and message
- Applied to the four operations that dereference `qos_cap` or manipulate uninitialized lists

The patch correctly identifies that other TM operations either only search lists (safe on uninitialized lists that are simply empty) or already check `VIRTCHNL_VF_OFFLOAD_QOS`, so they do not need the new check.

---

## Summary

All three patches are well-written bug fixes:

1. Patch 1 fixes a critical mismatched allocator / double-free bug
2. Patch 2 fixes a logic error in bandwidth configuration
3. Patch 3 fixes a NULL pointer dereference crash

The patches follow DPDK coding style, have appropriate Fixes tags and Cc: stable, and include clear commit messages explaining the bugs and fixes.

Review-Result: CLEAN