|WARNING| net/netvsc: fix event buffer leak on realloc failure

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: WARNING
https://dpdk.org/patch/172060

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-10-25

# Review of DPDK Patch: net/netvsc: fix event buffer leak on realloc failure

## ERRORS

**1. Incorrect realloc failure handling - use-after-free risk**

Line: `rxq->event_buf = rte_realloc(old_buf, rxq->event_sz, RTE_CACHE_LINE_SIZE);`

The code saves `old_buf` but still passes it to `rte_realloc()`.
On success, `rte_realloc()` may free `old_buf` and return a different pointer.
The subsequent `if (rxq->event_buf)` branch does `goto retry`,
which will attempt to use `rxq->event_buf` (the new allocation).
However, if realloc succeeds, `old_buf` now points to freed memory,
and on the failure path `rte_free(old_buf)` becomes a double-free.

The correct pattern is:
```c
void *old_buf = rxq->event_buf;
void *new_buf = rte_realloc(old_buf, rxq->event_sz, RTE_CACHE_LINE_SIZE);
if (new_buf != NULL) {
	rxq->event_buf = new_buf;
	goto retry;
}
/* realloc failed, old_buf is still valid, free it */
rte_free(old_buf);
rxq->event_buf = NULL;
rxq->event_sz = 0;
```

**Current code creates a double-free when realloc succeeds:**
- `rte_realloc()` frees `old_buf` internally and returns a new pointer
- On the next loop iteration that hits the failure path, `rte_free(old_buf)` frees already-freed memory

**2. Missing NULL assignment after free**

Line: `rte_free(old_buf);`

After freeing `old_buf` on the failure path, the code does not set `rxq->event_buf = NULL`.
While `rxq->event_sz = 0` will prevent further use in this code path,
leaving a dangling pointer in `rxq->event_buf` is unsafe --
other code that checks `if (rxq->event_buf)` will see a non-NULL pointer to freed memory.

Add: `rxq->event_buf = NULL;` after the `rte_free(old_buf);` line.

## Final Check

**Pass 1 (correctness bugs):** Both findings are resource management bugs (double-free, dangling pointer).

**Pass 2 (style false positives):** N/A - no style findings.

**Pass 3 (evidence verification):**
- Finding 1: Line quoted is `rxq->event_buf = rte_realloc(old_buf, ...)` - shows the realloc usage that causes double-free. Evidence present.
- Finding 2: Line quoted is `rte_free(old_buf);` - shows the free without subsequent NULL assignment. Evidence present.

Review-Result: ERROR