On 9 Feb 2026, at 14:29, Eli Britstein wrote:
> Introduce a new netdev type - netdev-doca.
> In order to compile, need to install doca on the build machine.
I had some time and ran the series through Coverity. Below is the list of
reported issues. I'm not sure if all of them are valid, but they might be worth
investigating.
Cheers,
Eelco
_____________________________________________________________________________________________
*** CID 501987: Memory - illegal accesses (STRING_NULL)
/lib/netdev-doca.c: 950 in get_pci()
944 } else if (len < PCI_PRI_STR_SIZE || len >= sizeof device) {
945 return E2BIG;
946 }
947 /* The result is like this: "../../../0000:08:00.0".
948 * Take the last 12 chars as the PCI address.
949 */
CID 501987: Memory - illegal accesses (STRING_NULL)
Passing unterminated string "device" to "strrchr", which expects a
null-terminated string.
950 slash = strrchr(device, '/');
951 if (!slash) {
952 return EINVAL;
953 }
954
955 ovs_strlcpy(pci, slash + 1, maxlen);
** CID 501986: Control flow issues (DEADCODE)
/lib/ovs-doca.c: 481 in ovs_doca_complete_queue_n()
_____________________________________________________________________________________________
*** CID 501986: Control flow issues (DEADCODE)
/lib/ovs-doca.c: 481 in ovs_doca_complete_queue_n()
475 if (qid == AUX_QUEUE) {
476 if (qid == AUX_QUEUE) {
477 ovs_mutex_lock(&esw->mgmt_queue_lock);
478 err = ovs_doca_complete_queue_n_protected(esw,
qid, min_room);
479 ovs_mutex_unlock(&esw->mgmt_queue_lock);
480 } else {
CID 501986: Control flow issues (DEADCODE)
Execution cannot reach this statement: "err = ovs_doca_complete_que...".
481 err = ovs_doca_complete_queue_n_protected(esw,
qid, min_room);
482 }
483 } else {
484 err = ovs_doca_complete_queue_n_protected(esw, qid, min_room);
485 }
486
** CID 501985: Memory - corruptions (OVERRUN)
/lib/ovs-doca.c: 624 in ovs_doca_remove_entry()
_____________________________________________________________________________________________
*** CID 501985: Memory - corruptions (OVERRUN)
/lib/ovs-doca.c: 624 in ovs_doca_remove_entry()
618 ovs_mutex_unlock(&esw->mgmt_queue_lock);
619 } else {
620 err = doca_flow_pipe_remove_entry(qid, flags, *entry);
621 }
622
623 if (err == DOCA_SUCCESS) {
CID 501985: Memory - corruptions (OVERRUN)
Overrunning array "esw->offload_queues" of 1 64-byte elements at element
index 1 (byte offset 127) using index "qid" (which evaluates to 1).
624 esw->offload_queues[qid].n_waiting_entries++;
625 if (qid == AUX_QUEUE) {
626 /* Ignore potential errors here, as even if the
queue completion
627 * failed, the entry removal would still be
issued. The caller
628 * requires knowing so. */
629 ovs_doca_complete_queue_esw(esw, qid, true);
** CID 501984: (LOCK)
/lib/netdev-doca.c: 3717 in netdev_doca_set_config()
/lib/netdev-doca.c: 3717 in netdev_doca_set_config()
_____________________________________________________________________________________________
*** CID 501984: (LOCK)
/lib/netdev-doca.c: 3717 in netdev_doca_set_config()
3711 is_rep = strstr(dev->devargs, "representor=");
3712 if (is_rep) {
3713 struct netdev_doca_esw_key esw_key;
3714 struct netdev_doca_esw_ctx *esw;
3715
3716 if (netdev_doca_esw_key_parse(dev->devargs, &esw_key)) {
CID 501984: (LOCK)
Returning without unlocking "doca_mutex.lock".
3717 return EINVAL;
3718 }
3719 esw = refmap_try_ref(netdev_doca_esw_rfm, &esw_key);
3720 if (!esw) {
3721 goto out;
3722 }
/lib/netdev-doca.c: 3717 in netdev_doca_set_config()
3711 is_rep = strstr(dev->devargs, "representor=");
3712 if (is_rep) {
3713 struct netdev_doca_esw_key esw_key;
3714 struct netdev_doca_esw_ctx *esw;
3715
3716 if (netdev_doca_esw_key_parse(dev->devargs, &esw_key)) {
CID 501984: (LOCK)
Returning without unlocking "(*dev).mutex.lock".
3717 return EINVAL;
3718 }
3719 esw = refmap_try_ref(netdev_doca_esw_rfm, &esw_key);
3720 if (!esw) {
3721 goto out;
3722 }
** CID 501983: Null pointer dereferences (REVERSE_INULL)
/lib/ovs-doca.c: 771 in ovs_doca_init()
_____________________________________________________________________________________________
*** CID 501983: Null pointer dereferences (REVERSE_INULL)
/lib/ovs-doca.c: 771 in ovs_doca_init()
765 {
766 const char *doca_init_val = smap_get_def(ovs_other_config,
"doca-init",
767 "false");
768 static bool enabled = false;
769 int rv;
770
CID 501983: Null pointer dereferences (REVERSE_INULL)
Null-checking "ovs_other_config" suggests that it may be null, but it has
already been dereferenced on all paths leading to the check.
771 if (enabled || !ovs_other_config) {
772 return;
773 }
774
775 if (!strcasecmp(doca_init_val, "true")) {
776 static struct ovsthread_once once_enable =
OVSTHREAD_ONCE_INITIALIZER;
** CID 501982: Concurrent data access violations (MISSING_LOCK)
/lib/netdev-doca.c: 3890 in netdev_doca_rxq_recv()
_____________________________________________________________________________________________
*** CID 501982: Concurrent data access violations (MISSING_LOCK)
/lib/netdev-doca.c: 3890 in netdev_doca_rxq_recv()
3884 if (!nb_rx) {
3885 return EAGAIN;
3886 }
3887
3888 if (qfill) {
3889 if (nb_rx == NETDEV_MAX_BURST) {
CID 501982: Concurrent data access violations (MISSING_LOCK)
Accessing "rx->port_id" without holding lock "ovs_mutex.lock". Elsewhere,
"netdev_rxq_doca.port_id" is written to with "ovs_mutex.lock" held 1 out of 1
times (1 of these accesses strongly imply that it is necessary).
3890 *qfill = rte_eth_rx_queue_count(rx->port_id,
rxq->queue_id);
3891 } else {
3892 *qfill = 0;
3893 }
3894 }
3895
** CID 501981: Memory - corruptions (OVERRUN)
/lib/ovs-doca.c: 561 in ovs_doca_add_generic()
_____________________________________________________________________________________________
*** CID 501981: Memory - corruptions (OVERRUN)
/lib/ovs-doca.c: 561 in ovs_doca_add_generic()
555
556 if (qid == AUX_QUEUE) {
557 ovs_mutex_unlock(&esw->mgmt_queue_lock);
558 }
559 if (err == DOCA_SUCCESS) {
560 if (queues) {
CID 501981: Memory - corruptions (OVERRUN)
Overrunning array of 64 bytes at byte offset 64 by dereferencing pointer
"queues + qid".
561 queues[qid].n_waiting_entries++;
562 } else {
563 VLOG_DBG("added entry %p without an eswitch
handle", *pentry);
564 }
565 }
566 return err;
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
