|SUCCESS| [v2, 3/3] net/iavf: fix crash in TM ops without QoS capability

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: SUCCESS
https://dpdk.org/patch/171774

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-10-20

# DPDK Patch Review

## Patch 1/3: net/iavf: fix invalid free of queue TC map

### Errors

None.

### Warnings

None.

### Info

This patch correctly fixes a double-free bug where `rte_free()` was called on a pointer allocated with `calloc()`, followed by `free()` on the same pointer. The fix properly removes the mismatched `rte_free()` calls, leaving only the correct `free()` for libc-allocated memory.

The patch also correctly removes a redundant `rte_free(vf->qtc_map)` in `iavf_uninit_vf()` that would have no effect (the pointer is already NULL after the preceding `free()`), but uses the wrong deallocator.

---

## Patch 2/3: net/iavf: fix bandwidth config of unshaped queues

### Errors

None.

### Warnings

None.

### Info

This patch correctly fixes a logic bug where `queue_id` and `tc` were only set for shaped queues. The move of these assignments outside the `if (tm_node->shaper_profile)` block ensures that unshaped queues properly identify themselves in the bandwidth configuration array, allowing the PF to reset them to default bandwidth.

The fix is correct: zero-initialized shaper rates combined with the correct queue_id/tc will properly communicate "no rate limit" for that specific queue.

---

## Patch 3/3: net/iavf: fix crash in TM ops without QoS capability

### Errors

None.

### Warnings

None.

### Info

This patch correctly addresses NULL pointer dereferences in TM operations when the PF does not grant `VIRTCHNL_VF_OFFLOAD_QOS`. The new `iavf_tm_qos_check()` helper properly validates that `qos_cap` exists before operations that require it.

The checks are placed correctly in the four operations that either dereference `qos_cap` or insert into TM lists:
- `iavf_tm_node_add()`
- `iavf_shaper_profile_add()` 
- `iavf_tm_capabilities_get()`
- `iavf_node_capabilities_get()`

Other TM operations that only search lists or already check the capability flag do not need the new check, as noted in the commit message.

The error reporting uses appropriate `RTE_TM_ERROR_TYPE_CAPABILITIES` and returns `-ENOTSUP`, which is the correct error code for an unsupported operation.

---

## Summary

All three patches are correct bug fixes with no coding style violations, correctness issues, or guideline violations. The changes are minimal, targeted, and appropriate for backport to stable branches (as indicated by the `Cc: stable at dpdk.org` tags on patches 2 and 3).

Review-Result: CLEAN