|SUCCESS| lpm: fix SVE bulk lookup loop bound for small bursts

dpdklab at iol.unh.edu dpdklab at iol.unh.edu
Tue Oct 27 17:57:10 CET 2026


Test-Label: ai-code-review
Test-Status: SUCCESS
https://dpdk.org/patch/172184

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-10-27

# DPDK Patch Review

## Correctness

**Error: Integer wraparound in loop condition causes out-of-bounds read**

The patch correctly identifies and fixes a critical bug. When `n < vl`, the original expression `n - vl` wraps to a very large value due to unsigned arithmetic (uint32_t `n` is promoted to uint64_t to match `vl`), causing the loop to read past the end of the `ips[]` array and trigger a segmentation fault.

The fix `i + vl < n` is correct and prevents the wraparound. The addition `i + vl` is well-defined for all reachable values (both operands are non-negative and cannot overflow in practice given realistic array sizes).

**Verification of tail handling:**

The existing tail code uses `svwhilelt_b32(i, n)` to create a predicate for remaining elements. This correctly handles:
- The case where `n == 0` (loop never executes, tail predicate is all-false)
- The case where `n < vl` (loop never executes, tail processes all n elements)
- The case where `n % vl != 0` (tail processes the final partial vector)

The fix is sound.

## Code Style

No style issues. The change is minimal and matches the surrounding code formatting.

## API and Documentation

Not applicable. This is an internal implementation fix with no API changes.

## Other Issues

None identified.

---

The patch correctly fixes a critical out-of-bounds access bug in the SVE bulk lookup function. The new loop condition prevents unsigned wraparound when `n < vl`, and the existing tail handling code correctly processes all remaining elements including edge cases.

Review-Result: CLEAN


More information about the test-report mailing list