|SUCCESS| lpm: fix SVE bulk lookup loop bound for small bursts
dpdklab at iol.unh.edu
dpdklab at iol.unh.edu
Tue Oct 27 17:57:10 CET 2026
Test-Label: ai-code-review
Test-Status: SUCCESS
https://dpdk.org/patch/172184
_AI Code Review_
=== Patch Review: series.patch (via Claude) ===
Review date: 2026-10-27
# DPDK Patch Review
## Correctness
**Error: Integer wraparound in loop condition causes out-of-bounds read**
The patch correctly identifies and fixes a critical bug. When `n < vl`, the original expression `n - vl` wraps to a very large value due to unsigned arithmetic (uint32_t `n` is promoted to uint64_t to match `vl`), causing the loop to read past the end of the `ips[]` array and trigger a segmentation fault.
The fix `i + vl < n` is correct and prevents the wraparound. The addition `i + vl` is well-defined for all reachable values (both operands are non-negative and cannot overflow in practice given realistic array sizes).
**Verification of tail handling:**
The existing tail code uses `svwhilelt_b32(i, n)` to create a predicate for remaining elements. This correctly handles:
- The case where `n == 0` (loop never executes, tail predicate is all-false)
- The case where `n < vl` (loop never executes, tail processes all n elements)
- The case where `n % vl != 0` (tail processes the final partial vector)
The fix is sound.
## Code Style
No style issues. The change is minimal and matches the surrounding code formatting.
## API and Documentation
Not applicable. This is an internal implementation fix with no API changes.
## Other Issues
None identified.
---
The patch correctly fixes a critical out-of-bounds access bug in the SVE bulk lookup function. The new loop condition prevents unsigned wraparound when `n < vl`, and the existing tail handling code correctly processes all remaining elements including edge cases.
Review-Result: CLEAN
More information about the test-report
mailing list