|WARNING| [v3,8/8] interrupts: warn on leaked event FDs

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: WARNING
https://dpdk.org/patch/171919

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-10-23

# DPDK Patch Review

## Patch 1/8: interrupts: fix size of duplicated instance

### Errors

**Missing bounds check on source nb_intr before memcpy (Error)**

Line 134-135:
```c
memcpy(intr_handle->efds, src->efds, src->nb_intr * sizeof(*src->efds));
memcpy(intr_handle->elist, src->elist, src->nb_intr * sizeof(*src->elist));
```

The code calls `rte_intr_event_list_update(intr_handle, src->nb_intr)` to grow the destination,
but does not verify that the reallocation succeeded in making `intr_handle->nb_intr` equal to `src->nb_intr`.
If `rte_intr_event_list_update()` grows the arrays but `nb_intr` remains smaller than `src->nb_intr`
(which could occur if the update function has a bug or internal constraint),
the subsequent `memcpy()` writes past the end of the destination arrays.

Verify `intr_handle->nb_intr >= src->nb_intr` after calling `rte_intr_event_list_update()`,
or check that the update function guarantees this and document the assumption.

---

## Patch 2/8: interrupts: fix event arrays copy on instance duplication

### Info

**Already fixed by Patch 1**

Patch 1 adds the correct `sizeof` multiplier to the `memcpy()` calls on lines 134-135.
This patch duplicates that fix and will conflict when applied after Patch 1.
The series should either squash Patch 2 into Patch 1, or Patch 2 should be dropped.

---

## Patch 3/8: eal/linux: fix closing of event FDs not owned by EAL

No issues found.

---

## Patch 4/8: eal/linux: fix eventfd leaks when enabling interrupts

### Warnings

**Loop variable declaration hides function-scope variable (Warning)**

Line 1577:
```c
uint32_t i;
```
Line 1632:
```c
for (int i = 0; i < rte_intr_nb_efd_get(intr_handle); i++) {
```

The error cleanup path declares `int i` in the `for` loop, but the function already declared `uint32_t i` at the top of the MSI-X block.
The inner declaration shadows the outer one within the error path.
While not a bug (the loop's `i` is scoped to the loop and the outer `i` is no longer used),
it is a style inconsistency: the MSI-X allocation loop uses the outer `i`,
while the error path loop uses a new inner `i`.

Either remove the outer `uint32_t i;` declaration and use `for (uint32_t i = 0; ...)` in both loops,
or declare `int i;` for the error loop at the top of the function alongside the existing `int fd, ret;`.

---

## Patch 5/8: eal/linux: fix leaked FD warnings for interrupt sources

No issues found.

---

## Patch 6/8: eal/freebsd: fix interrupt source handle leak

No issues found.

---

## Patch 7/8: bus/pci: fix leaked device FD warning on VFIO unmap

No issues found.

---

## Patch 8/8: interrupts: warn on leaked event FDs

No issues found.

---

## Summary

The series fixes several resource management bugs in the interrupt handling subsystem:
handle duplication, eventfd ownership, and FD leak warnings.

**Critical issue:** Patch 1 copies `src->nb_intr` elements into arrays that may not have been grown to that size,
risking an out-of-bounds write if `rte_intr_event_list_update()` does not guarantee the size increase.

**Conflict:** Patch 2 duplicates the fix already present in Patch 1 (the `sizeof` multiplier correction)
and should be dropped or squashed.

**Style:** Patch 4 has a variable shadowing pattern (outer `uint32_t i` shadowed by loop-scoped `int i` in error path).

Review-Result: ERROR