From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <dev-bounces@dpdk.org>
Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124])
	by inbox.dpdk.org (Postfix) with ESMTP id 6EAE2457B5;
	Wed, 14 Aug 2024 04:30:34 +0200 (CEST)
Received: from mails.dpdk.org (localhost [127.0.0.1])
	by mails.dpdk.org (Postfix) with ESMTP id 632D1402E0;
	Wed, 14 Aug 2024 04:30:32 +0200 (CEST)
Received: from inbox.dpdk.org (inbox.dpdk.org [95.142.172.178])
 by mails.dpdk.org (Postfix) with ESMTP id 6FD97402A8
 for <dev@dpdk.org>; Wed, 14 Aug 2024 04:30:31 +0200 (CEST)
Received: by inbox.dpdk.org (Postfix, from userid 33)
 id 3FE96457B8; Wed, 14 Aug 2024 04:30:31 +0200 (CEST)
From: bugzilla@dpdk.org
To: dev@dpdk.org
Subject: [DPDK/ethdev Bug 1521] Potential null dereference in mlx5
Date: Wed, 14 Aug 2024 02:30:30 +0000
X-Bugzilla-Reason: AssignedTo
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: DPDK
X-Bugzilla-Component: ethdev
X-Bugzilla-Version: unspecified
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: stephen@networkplumber.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: Normal
X-Bugzilla-Assigned-To: dev@dpdk.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform
 op_sys bug_status bug_severity priority component assigned_to reporter
 target_milestone
Message-ID: <bug-1521-3@http.bugs.dpdk.org/>
Content-Type: multipart/alternative; boundary=17236026310.60917.3990773
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://bugs.dpdk.org/
Auto-Submitted: auto-generated
X-Auto-Response-Suppress: All
MIME-Version: 1.0
X-BeenThere: dev@dpdk.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: DPDK patches and discussions <dev.dpdk.org>
List-Unsubscribe: <https://mails.dpdk.org/options/dev>,
 <mailto:dev-request@dpdk.org?subject=unsubscribe>
List-Archive: <http://mails.dpdk.org/archives/dev/>
List-Post: <mailto:dev@dpdk.org>
List-Help: <mailto:dev-request@dpdk.org?subject=help>
List-Subscribe: <https://mails.dpdk.org/listinfo/dev>,
 <mailto:dev-request@dpdk.org?subject=subscribe>
Errors-To: dev-bounces@dpdk.org


--17236026310.60917.3990773
Date: Wed, 14 Aug 2024 04:30:30 +0200
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://bugs.dpdk.org/
Auto-Submitted: auto-generated
X-Auto-Response-Suppress: All

https://bugs.dpdk.org/show_bug.cgi?id=3D1521

            Bug ID: 1521
           Summary: Potential null dereference in mlx5
           Product: DPDK
           Version: unspecified
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Severity: normal
          Priority: Normal
         Component: ethdev
          Assignee: dev@dpdk.org
          Reporter: stephen@networkplumber.org
  Target Milestone: ---

Building DPDK 24.11-rc0 with gcc 14 and analyzer (-fanalyzer) shows this
(wordy) error.

../drivers/net/mlx5/mlx5_flow_hw.c: In function
=E2=80=98mlx5_tbl_ensure_shared_modify_header=E2=80=99:
../drivers/net/mlx5/mlx5_flow_hw.c:2351:72: warning: dereference of NULL =
=E2=80=980=E2=80=99
[CWE-476] [-Wanalyzer-null-dereference]
 2351 |                 .sz =3D sizeof(struct mlx5_modification_cmd) *
acts->mhdr->mhdr_cmds_num
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~^~~~~~~~~~~~~~~
  =E2=80=98mlx5_flow_hw_ctrl_flows=E2=80=99: events 1-4
    |
    |15933 | mlx5_flow_hw_ctrl_flows(struct rte_eth_dev *dev, uint32_t flag=
s)
    |      | ^~~~~~~~~~~~~~~~~~~~~~~
    |      | |
    |      | (1) entry to =E2=80=98mlx5_flow_hw_ctrl_flows=E2=80=99
    |......
    |15943 |         if (!priv->dr_ctx) {
    |      |            ~
    |      |            |
    |      |            (2) following =E2=80=98false=E2=80=99 branch...
    |......
    |15949 |         if (!priv->hw_ctrl_rx) {
    |      |            ~ ~~~~~~~~~~~~~~~~
    |      |            |     |
    |      |            |     (3) ...to here
    |      |            (4) following =E2=80=98false=E2=80=99 branch...
    |
  =E2=80=98mlx5_flow_hw_ctrl_flows=E2=80=99: event 5
    |
    |cc1:
    | (5): ...to here
    |
  =E2=80=98mlx5_flow_hw_ctrl_flows=E2=80=99: events 6-8
    |
    |15956 |         for (i =3D 0; i < MLX5_FLOW_HW_CTRL_RX_ETH_PATTERN_MAX=
; ++i)
{
    |      |                     ~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                       |
    |      |                       (6) following =E2=80=98true=E2=80=99 bra=
nch (when =E2=80=98i !=3D
10=E2=80=99)...
    |......
    |15959 |                 if
(!eth_pattern_type_is_requested(eth_pattern_type, flags))
    |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                      |
    |      |                      (7) ...to here
    |      |                      (8) calling =E2=80=98eth_pattern_type_is_=
requested=E2=80=99
from =E2=80=98mlx5_flow_hw_ctrl_flows=E2=80=99
    |
    +--> =E2=80=98eth_pattern_type_is_requested=E2=80=99: event 9
           |
           |15668 | eth_pattern_type_is_requested(const enum
mlx5_flow_ctrl_rx_eth_pattern_type eth_pattern_type,
           |      | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      | |
           |      | (9) entry to =E2=80=98eth_pattern_type_is_requested=E2=
=80=99
           |
         =E2=80=98eth_pattern_type_is_requested=E2=80=99: event 10
           |
           |cc1:
           | (10): following =E2=80=98true=E2=80=99 branch (when =E2=80=98e=
th_pattern_type <=3D 9=E2=80=99)...
           |
         =E2=80=98eth_pattern_type_is_requested=E2=80=99: event 11
           |
           |15672 |         uint32_t vlan_flags =3D
__calc_vlan_flags(eth_pattern_type);
           |      |                               ^
           |      |                               |
           |      |                               (11) inlined call to
=E2=80=98__calc_vlan_flags=E2=80=99 from =E2=80=98eth_pattern_type_is_reque=
sted=E2=80=99
           |
           +--> =E2=80=98__calc_vlan_flags=E2=80=99: events 12-13
                  |
                  |15656 |         switch (eth_pattern_type) {
                  |      |         ^~~~~~
                  |      |         |
                  |      |         (12) ...to here
                  |      |         (13) following =E2=80=98default:=E2=80=
=99 branch...
                  |
           <------+
           |
         =E2=80=98eth_pattern_type_is_requested=E2=80=99: event 14
           |
           |cc1:
           | (14): ...to here
           |
         =E2=80=98eth_pattern_type_is_requested=E2=80=99: events 15-16
           |
           |15674 |         bool consider_vlan =3D vlan_flags ||
(MLX5_CTRL_VLAN_FILTER & flags);
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |                                         |=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20
      |
           |      |                                         |=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20
      (16) ...to here
           |      |                                         (15) following
=E2=80=98false=E2=80=99 branch...
           |
    <------+
    |
  =E2=80=98mlx5_flow_hw_ctrl_flows=E2=80=99: events 17-18
    |
    |15959 |                 if
(!eth_pattern_type_is_requested(eth_pattern_type, flags))
    |      |                    ~
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                    | |
    |      |                    | (17) returning to =E2=80=98mlx5_flow_hw_c=
trl_flows=E2=80=99
from =E2=80=98eth_pattern_type_is_requested=E2=80=99
    |      |                    (18) following =E2=80=98true=E2=80=99 branc=
h...
    |
  =E2=80=98mlx5_flow_hw_ctrl_flows=E2=80=99: event 19
    |
    |cc1:
    | (19): ...to here
    |
  =E2=80=98mlx5_flow_hw_ctrl_flows=E2=80=99: events 20-26
    |
    |15961 |                 for (j =3D 0; j <
MLX5_FLOW_HW_CTRL_RX_EXPANDED_RSS_MAX; ++j) {
    |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20
~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                               |
    |      |                               (20) following =E2=80=98true=E2=
=80=99 branch (when
=E2=80=98j !=3D 7=E2=80=99)...
    |......
    |15965 |                         const struct mlx5_flow_template_table_=
cfg
cfg =3D {
    |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
~~~
    |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
|
    |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
(21) ...to here
    |......
    |15978 |                         if (!rss_type_is_requested(priv,
rss_type))
    |      |                            ~=20=20=20
    |      |                            |
    |      |                            (22) following =E2=80=98true=E2=80=
=99 branch...
    |15979 |                                 continue;
    |15980 |                         if (!tmpls->tbl) {
    |      |                            ~ ~~~~~~~~~~
    |      |                            |      |
    |      |                            |      (23) ...to here
    |      |                            (24) following =E2=80=98true=E2=80=
=99 branch...
    |15981 |                                 tmpls->tbl =3D
flow_hw_table_create(dev, &cfg,
    |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                                              |
    |      |                                              (25) ...to here
    |      |                                              (26) calling
=E2=80=98flow_hw_table_create=E2=80=99 from =E2=80=98mlx5_flow_hw_ctrl_flow=
s=E2=80=99
    |15982 |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
&tmpls->pt, 1, &at, 1, NULL);
    |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |
    +--> =E2=80=98flow_hw_table_create=E2=80=99: events 27-28
           |
           | 4978 | flow_hw_table_create(struct rte_eth_dev *dev,
           |      | ^~~~~~~~~~~~~~~~~~~~
           |      | |
           |      | (27) entry to =E2=80=98flow_hw_table_create=E2=80=99
           |......
           | 5021 |         if
(!flow_hw_validate_table_domain(&attr->flow_attr)) {
           |      |            ~
           |      |            |
           |      |            (28) following =E2=80=98false=E2=80=99 branc=
h...
           |
         =E2=80=98flow_hw_table_create=E2=80=99: event 29
           |
           |cc1:
           | (29): ...to here
           |
         =E2=80=98flow_hw_table_create=E2=80=99: events 30-49
           |
           | 5026 |         for (i =3D 0; i < nb_item_templates; i++) {
           |      |                     ~~^~~~~~~~~~~~~~~~~~~  ~~~
           |      |                       |                     |
           |      |                       |                     (33) ...to =
here
           |      |                       (30) following =E2=80=98true=E2=
=80=99 branch...
           | 5027 |                 const struct rte_flow_pattern_template_=
attr
*pt_attr =3D
           | 5028 |                         &item_templates[i]->attr;
           |      |                                        ~
           |      |                                        |
           |      |                                        (31) ...to here
           |......
           | 5033 |                 if (!match) {
           |      |                    ~=20=20=20
           |      |                    |
           |      |                    (32) following =E2=80=98true=E2=80=
=99 branch...
           |......
           | 5040 |         for (i =3D 0; i < nb_action_templates; i++) {
           |      |                     ~~~~~~~~~~~~~~~~~~~~~~~  ~~~
           |      |                       |                       |
           |      |                       |                       (37) ...to
here
           |      |                       (34) following =E2=80=98true=E2=
=80=99 branch...
           | 5041 |                 const struct rte_flow_actions_template =
*at
=3D action_templates[i];
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
                 ~
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
                 |
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
                 (35) ...to here
           |......
           | 5046 |                 if (!match) {
           |      |                    ~=20=20=20
           |      |                    |
           |      |                    (36) following =E2=80=98true=E2=80=
=99 branch...
           |......
           | 5068 |         if (nb_item_templates > max_tpl ||
           |      |            ~=20=20=20=20=20=20=20=20=20=20=20
           |      |            |
           |      |            (38) following =E2=80=98false=E2=80=99 branc=
h...
           |......
           | 5080 |         tbl_mem_size +=3D nb_action_templates *
priv->nb_queue * sizeof(tbl->rule_acts[0]);
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20
~~~~~~~~~~~~~~
           |      |                                                   |
           |      |                                                   (39)
...to here
           |......
           | 5083 |         if (!tbl)
           |      |            ~=20=20=20=20=20=20=20=20=20=20=20
           |      |            |
           |      |            (40) following =E2=80=98false=E2=80=99 branc=
h (when =E2=80=98tbl=E2=80=99 is
non-NULL)...
           | 5084 |                 goto error;
           | 5085 |         tbl->cfg =3D *table_cfg;
           |      |         ~~~~~~~~~~~~~~~~~~~~~
           |      |                  |
           |      |                  (41) ...to here
           |......
           | 5088 |         if (!tbl->flow)
           |      |            ~=20=20=20=20=20=20=20=20=20=20=20
           |      |            |
           |      |            (42) following =E2=80=98false=E2=80=99 branc=
h...
           |......
           | 5092 |                                     RTE_CACHE_LINE_SIZE,
rte_dev_numa_node(dev->device));
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
               ~~~~~~~~~~~
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
                  |
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
                  (43) ...to here
           | 5093 |         if (!tbl->flow_aux)
           |      |            ~=20=20=20=20=20=20=20=20=20=20=20
           |      |            |
           |      |            (44) following =E2=80=98false=E2=80=99 branc=
h...
           |......
           | 5096 |         ge =3D mlx5_hlist_register(priv->sh->groups,
attr->flow_attr.group, &ctx);
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
      |
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
      (45) ...to here
           | 5097 |         if (!ge)
           |      |            ~=20=20=20=20=20=20=20=20=20=20=20
           |      |            |
           |      |            (46) following =E2=80=98false=E2=80=99 branc=
h (when =E2=80=98ge=E2=80=99 is
non-NULL)...
           |......
           | 5100 |         tbl->grp =3D grp;
           |      |         ~~~~~~~~~~~~~~=20
           |      |                  |
           |      |                  (47) ...to here
           |......
           | 5109 |         if (attr->hash_func =3D=3D
RTE_FLOW_TABLE_HASH_FUNC_CRC16) {
           |      |            ~=20=20=20=20=20=20=20=20=20=20=20
           |      |            |
           |      |            (48) following =E2=80=98false=E2=80=99 branc=
h...
           |......
           | 5114 |         matcher_attr.distribute_mode =3D
flow_hw_matcher_distribute_mode_get(attr->hash_func);
           |      |                                        ~
           |      |                                        |
           |      |                                        (49) inlined cal=
l to
=E2=80=98flow_hw_matcher_distribute_mode_get=E2=80=99 from =E2=80=98flow_hw=
_table_create=E2=80=99
           |
           +--> =E2=80=98flow_hw_matcher_distribute_mode_get=E2=80=99: even=
t 50
                  |
                  |  481 |         if (hash_func =3D=3D
RTE_FLOW_TABLE_HASH_FUNC_LINEAR)
                  |      |            ^
                  |      |            |
                  |      |            (50) ...to here
                  |
           <------+
           |
         =E2=80=98flow_hw_table_create=E2=80=99: events 51-57
           |
           | 5137 |         for (i =3D 0; i < nb_item_templates; i++) {
           |      |                     ~~^~~~~~~~~~~~~~~~~~~
           |      |                       |
           |      |                       (51) following =E2=80=98true=E2=
=80=99 branch...
           |      |                       (55) following =E2=80=98false=E2=
=80=99 branch...
           |......
           | 5140 |                 if ((flow_attr.ingress &&
!item_templates[i]->attr.ingress) ||
           |      |                      ~~~~~~~~~~~~~~~~~
           |      |                      |
           |      |                      (52) ...to here
           |......
           | 5151 |                 if (ret <=3D 1) {
           |      |                    ~=20=20=20
           |      |                    |
           |      |                    (53) following =E2=80=98false=E2=80=
=99 branch...
           |......
           | 5155 |                 mt[i] =3D item_templates[i]->mt;
           |      |                         ~~~~~~~~~~~~~~~~~
           |      |                                       |
           |      |                                       (54) ...to here
           |......
           | 5158 |         tbl->nb_item_templates =3D nb_item_templates;
           |      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |                                |
           |      |                                (56) ...to here
           | 5159 |         /* Build the action template. */
           | 5160 |         err =3D mlx5_hw_build_template_table(dev,
nb_action_templates,
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |               |
           |      |               (57) calling =E2=80=98mlx5_hw_build_templ=
ate_table=E2=80=99
from =E2=80=98flow_hw_table_create=E2=80=99
           | 5161 |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
action_templates, at, tbl, &sub_error);
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |
           +--> =E2=80=98mlx5_hw_build_template_table=E2=80=99: events 58-59
                  |
                  | 4876 | mlx5_hw_build_template_table(struct rte_eth_dev
*dev,
                  |      | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
                  |      | |
                  |      | (58) entry to =E2=80=98mlx5_hw_build_template_ta=
ble=E2=80=99
                  |......
                  | 4886 |         for (i =3D 0; i < nb_action_templates; i=
++) {
                  |      |                     ~~~~~~~~~~~~~~~~~~~~~~~
                  |      |                       |
                  |      |                       (59) following =E2=80=98tr=
ue=E2=80=99 branch
(when =E2=80=98i < nb_action_templates=E2=80=99)...
                  |
                =E2=80=98mlx5_hw_build_template_table=E2=80=99: event 60
                  |
                  | 4887 |                 uint32_t refcnt =3D
rte_atomic_fetch_add_explicit(&action_templates[i]->refcnt, 1,
                  |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20
                            ^
                  |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20
                            |
                  |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20
                            (60) ...to here
../lib/eal/include/rte_stdatomic.h:159:28: note: in definition of macro
=E2=80=98rte_atomic_fetch_add_explicit=E2=80=99
                  |  159 |         __atomic_fetch_add(ptr, val, memorder)
                  |      |                            ^~~
                  |
                =E2=80=98mlx5_hw_build_template_table=E2=80=99: events 61-65
                  |
                  |../drivers/net/mlx5/mlx5_flow_hw.c:4890:20:
                  | 4890 |                 if (refcnt <=3D 1) {
                  |      |                    ^
                  |      |                    |
                  |      |                    (61) following =E2=80=98false=
=E2=80=99 branch...
                  |......
                  | 4896 |                 at[i] =3D action_templates[i]->t=
mpl;
                  |      |                         ~~~~~~~~~~~~~~~~~~~
                  |      |                                         |
                  |      |                                         (62) ...=
to
here
                  |......
                  | 4900 |                 if (!dev->data->dev_started)
                  |      |                    ~
                  |      |                    |
                  |      |                    (63) following =E2=80=98false=
=E2=80=99 branch...
                  | 4901 |                         continue;
                  | 4902 |                 ret =3D
flow_hw_translate_actions_template(dev, &tbl->cfg,
                  |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                  |      |                       |
                  |      |                       (64) ...to here
                  |      |                       (65) inlined call to
=E2=80=98flow_hw_translate_actions_template=E2=80=99 from =E2=80=98mlx5_hw_=
build_template_table=E2=80=99
                  | 4903 |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20
&tbl->ats[i].acts,
                  |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~
                  | 4904 |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20
action_templates[i],
                  |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~
                  | 4905 |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20
&tbl->mpctx, error);
                  |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~
                  |
                  +--> =E2=80=98flow_hw_translate_actions_template=E2=80=99=
: event 66
                         |
                         | 2977 |         return
__flow_hw_translate_actions_template(dev, cfg, acts, at, mp_ctx, false, err=
or);
                         |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=
~~~
                         |      |                |
                         |      |                (66) calling
=E2=80=98__flow_hw_translate_actions_template=E2=80=99 from =E2=80=98mlx5_h=
w_build_template_table=E2=80=99
                         |
                       =E2=80=98__flow_hw_translate_actions_template=E2=80=
=99: events 67-74
                         |
                         | 2468 | __flow_hw_translate_actions_template(stru=
ct
rte_eth_dev *dev,
                         |      | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                         |      | |
                         |      | (67) entry to
=E2=80=98__flow_hw_translate_actions_template=E2=80=99
                         |......
                         | 2510 |         for (; !actions_end; actions++,
masks++) {
                         |      |                ~~~~~~~~~~~~
                         |      |                |
                         |      |                (68) following =E2=80=98fa=
lse=E2=80=99 branch
(when =E2=80=98actions_end =3D=3D 0=E2=80=99)...
                         |      |                (70) following =E2=80=98tr=
ue=E2=80=99 branch
(when =E2=80=98actions_end !=3D 0=E2=80=99)...
                         | 2511 |                 uint64_t pos =3D actions -
at->actions;
                         |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20
~~~~~~~~~~~
                         |      |                                          =
  |
                         |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20
(69) ...to here
                         |......
                         | 2899 |         if (mhdr.pos !=3D UINT16_MAX) {
                         |      |            ~~~~~~~~~
                         |      |            |    |
                         |      |            |    (71) ...to here
                         |      |            (72) following =E2=80=98true=
=E2=80=99 branch...
                         | 2900 |                 ret =3D
mlx5_tbl_translate_modify_header(dev, cfg, acts, mp_ctx, &mhdr, error);
                         |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                         |      |                       |
                         |      |                       (73) ...to here
                         |      |                       (74) calling
=E2=80=98mlx5_tbl_translate_modify_header=E2=80=99 from =E2=80=98__flow_hw_=
translate_actions_template=E2=80=99
                         |
                         +--> =E2=80=98mlx5_tbl_translate_modify_header=E2=
=80=99: events 75-76
                                |
                                | 2305 |
mlx5_tbl_translate_modify_header(struct rte_eth_dev *dev,
                                |      | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                |      | |
                                |      | (75) entry to
=E2=80=98mlx5_tbl_translate_modify_header=E2=80=99
                                |......
                                | 2317 |         if
(flow_hw_validate_compiled_modify_field(dev, cfg, mhdr, error)) {
                                |      |=20=20=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                |      |             |
                                |      |             (76) calling
=E2=80=98flow_hw_validate_compiled_modify_field=E2=80=99 from
=E2=80=98mlx5_tbl_translate_modify_header=E2=80=99
                                |
                                +--> =E2=80=98flow_hw_validate_compiled_mod=
ify_field=E2=80=99:
events 77-81
                                       |
                                       | 1662 |
flow_hw_validate_compiled_modify_field(struct rte_eth_dev *dev,
                                       |      |
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                       |      | |
                                       |      | (77) entry to
=E2=80=98flow_hw_validate_compiled_modify_field=E2=80=99
                                       |......
                                       | 1675 |         if
(cfg->attr.flow_attr.group !=3D 0 &&
                                       |      |=20=20=20=20=20=20=20=20=20=
=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                       |      |            |=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20
           |
                                       |      |            |=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20
           (80) following =E2=80=98true=E2=80=99 branch...
                                       |      |            (78) following
=E2=80=98true=E2=80=99 branch...
                                       | 1676 |             mhdr->mhdr_cmds=
_num
> hca_attr->max_header_modify_pattern_length) {
                                       |      |=20=20=20=20=20=20=20=20=20=
=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                       |      |                 |
                                       |      |                 (79) ...to =
here
                                       | 1677 |                 uint32_t no=
ps =3D
flow_hw_count_nop_modify_field(mhdr);
                                       |      |=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                       |      |=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
|
                                       |      |=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
(81) ...to here
                                       |
                                <------+
                                |
                              =E2=80=98mlx5_tbl_translate_modify_header=E2=
=80=99: events 82-85
                                |
                                | 2317 |         if
(flow_hw_validate_compiled_modify_field(dev, cfg, mhdr, error)) {
                                |      |=20=20=20=20=20=20=20=20=20=20=20
~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                |      |            ||
                                |      |            |(82) returning to
=E2=80=98mlx5_tbl_translate_modify_header=E2=80=99 from
=E2=80=98flow_hw_validate_compiled_modify_field=E2=80=99
                                |      |            (83) following =E2=80=
=98true=E2=80=99
branch...
                                | 2318 |=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20
__flow_hw_action_template_destroy(dev, acts);
                                |      |=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                |      |                 |
                                |      |                 (84) ...to here
                                |      |                 (85) calling
=E2=80=98__flow_hw_action_template_destroy=E2=80=99 from =E2=80=98mlx5_tbl_=
translate_modify_header=E2=80=99
                                |
                                +--> =E2=80=98__flow_hw_action_template_des=
troy=E2=80=99:
events 86-87
                                       |
                                       |  943 |
__flow_hw_action_template_destroy(struct rte_eth_dev *dev, struct
mlx5_hw_actions *acts)
                                       |      |
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                       |      | |
                                       |      | (86) entry to
=E2=80=98__flow_hw_action_template_destroy=E2=80=99
                                       |......
                                       |  954 |=20=20=20=20=20=20=20=20
__flow_hw_actions_release(dev, acts);
                                       |      |=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                       |      |         |
                                       |      |         (87) calling
=E2=80=98__flow_hw_actions_release=E2=80=99 from =E2=80=98__flow_hw_action_=
template_destroy=E2=80=99
                                       |
                                       +--> =E2=80=98__flow_hw_actions_rele=
ase=E2=80=99: events
88-90
                                              |
                                              |  884 |
__flow_hw_actions_release(struct rte_eth_dev *dev, struct mlx5_hw_actions
*acts)
                                              |      |
^~~~~~~~~~~~~~~~~~~~~~~~~
                                              |      | |
                                              |      | (88) entry to
=E2=80=98__flow_hw_actions_release=E2=80=99
                                              |......
                                              |  916 |         if (acts->mh=
dr)
{
                                              |      |            ~
                                              |      |            |
                                              |      |            (89)
following =E2=80=98true=E2=80=99 branch...
                                              |  917 |=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20
flow_hw_template_destroy_mhdr_action(acts->mhdr);
                                              |      |                 ~
                                              |      |                 |
                                              |      |                 (90)
inlined call to =E2=80=98flow_hw_template_destroy_mhdr_action=E2=80=99 from
=E2=80=98__flow_hw_actions_release=E2=80=99
                                              |
                                              +-->
=E2=80=98flow_hw_template_destroy_mhdr_action=E2=80=99: event 91
                                                     |
                                                     |  868 |         if
(mhdr->action && !mhdr->multi_pattern)
                                                     |      |=20=20=20=20=
=20=20=20=20=20=20=20=20
~~~~^~~~~~~~
                                                     |      |              =
   |
                                                     |      |=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20
(91) ...to here
                                                     |
                                              <------+
                                              |
                                            =E2=80=98__flow_hw_actions_rele=
ase=E2=80=99: events
92-96
                                              |
                                              |  919 |=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20
acts->mhdr =3D NULL;
                                              |      |=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
  ^
                                              |      |=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
  |
                                              |      |=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
  (92) =E2=80=980=E2=80=99 is NULL
                                              |  920 |         }
                                              |  921 |         if
(mlx5_hws_cnt_id_valid(acts->cnt_id)) {
                                              |      |            ~=20=20=
=20=20=20=20=20=20=20=20=20=20=20
                                              |      |            |
                                              |      |            (93)
following =E2=80=98false=E2=80=99 branch...
                                              |......
                                              |  925 |         if
(acts->mtr_id) {
                                              |      |            ~~~~~~~~~=
~~~~=20
                                              |      |            |    |
                                              |      |            |    (94)
...to here
                                              |      |            (95)
following =E2=80=98false=E2=80=99 branch...
                                              |......
                                              |  929 | }
                                              |      | ~=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
                                              |      | |
                                              |      | (96) ...to here
                                              |
                                       <------+
                                       |
                                     =E2=80=98__flow_hw_action_template_des=
troy=E2=80=99: event
97
                                       |
                                       |  954 |=20=20=20=20=20=20=20=20
__flow_hw_actions_release(dev, acts);
                                       |      |=20=20=20=20=20=20=20=20
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                       |      |         |
                                       |      |         (97) returning to
=E2=80=98__flow_hw_action_template_destroy=E2=80=99 from =E2=80=98__flow_hw=
_actions_release=E2=80=99
                                       |
                                <------+
                                |
                              =E2=80=98mlx5_tbl_translate_modify_header=E2=
=80=99: event 98
                                |
                                | 2318 |=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20
__flow_hw_action_template_destroy(dev, acts);
                                |      |=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                |      |                 |
                                |      |                 (98) returning to
=E2=80=98mlx5_tbl_translate_modify_header=E2=80=99 from =E2=80=98__flow_hw_=
action_template_destroy=E2=80=99
                                |
                         <------+
                         |
                       =E2=80=98__flow_hw_translate_actions_template=E2=80=
=99: events 99-106
                         |
                         | 2900 |                 ret =3D
mlx5_tbl_translate_modify_header(dev, cfg, acts, mp_ctx, &mhdr, error);
                         |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                         |      |                       |
                         |      |                       (99) returning to
=E2=80=98__flow_hw_translate_actions_template=E2=80=99 from =E2=80=98mlx5_t=
bl_translate_modify_header=E2=80=99
                         | 2901 |                 if (ret)
                         |      |                    ~=20=20=20
                         |      |                    |
                         |      |                    (100) following =E2=80=
=98false=E2=80=99
branch (when =E2=80=98ret =3D=3D 0=E2=80=99)...
                         | 2902 |                         goto err;
                         | 2903 |                 if (!nt_mode && mhdr.shar=
ed)
{
                         |      |                    ~~~~~~~~~~~~~~~~~~~~~~=
~~
                         |      |                    |         |
                         |      |                    |         (103) ...to =
here
                         |      |                    |         (104) follow=
ing
=E2=80=98true=E2=80=99 branch...
                         |      |                    (101) ...to here
                         |      |                    (102) following =E2=80=
=98false=E2=80=99
branch (when =E2=80=98nt_mode =3D=3D 0=E2=80=99)...
                         | 2904 |                         ret =3D
mlx5_tbl_ensure_shared_modify_header(dev, cfg, acts, error);
                         |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                         |      |                               |
                         |      |                               (105) ...to
here
                         |      |                               (106) calli=
ng
=E2=80=98mlx5_tbl_ensure_shared_modify_header=E2=80=99 from
=E2=80=98__flow_hw_translate_actions_template=E2=80=99
                         |
                         +--> =E2=80=98mlx5_tbl_ensure_shared_modify_header=
=E2=80=99: events
107-109
                                |
                                | 2341 |
mlx5_tbl_ensure_shared_modify_header(struct rte_eth_dev *dev,
                                |      | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=
~~
                                |      | |
                                |      | (107) entry to
=E2=80=98mlx5_tbl_ensure_shared_modify_header=E2=80=99
                                |......
                                | 2351 |                 .sz =3D sizeof(str=
uct
mlx5_modification_cmd) * acts->mhdr->mhdr_cmds_num
                                |      |=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20
                      ~~~~~~~~~~~~~~~~~~~~~~~~~
                                |      |=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20
                          |     |
                                |      |=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20
                          |     (109) dereference of NULL =E2=80=98*acts.mh=
dr=E2=80=99
                                |      |=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20
                          (108) =E2=80=980=E2=80=99 is NULL
                                |

--=20
You are receiving this mail because:
You are the assignee for the bug.=

--17236026310.60917.3990773
Date: Wed, 14 Aug 2024 04:30:31 +0200
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://bugs.dpdk.org/
Auto-Submitted: auto-generated
X-Auto-Response-Suppress: All

<html>
    <head>
      <base href=3D"https://bugs.dpdk.org/">
    </head>
    <body><table border=3D"1" cellspacing=3D"0" cellpadding=3D"8" class=3D"=
bz_new_table">
        <tr>
          <th>Bug ID</th>
          <td><a class=3D"bz_bug_link=20
          bz_status_UNCONFIRMED "
   title=3D"UNCONFIRMED - Potential null dereference in mlx5"
   href=3D"https://bugs.dpdk.org/show_bug.cgi?id=3D1521">1521</a>
          </td>
        </tr>

        <tr>
          <th>Summary</th>
          <td>Potential null dereference in mlx5
          </td>
        </tr>

        <tr>
          <th>Product</th>
          <td>DPDK
          </td>
        </tr>

        <tr>
          <th>Version</th>
          <td>unspecified
          </td>
        </tr>

        <tr>
          <th>Hardware</th>
          <td>All
          </td>
        </tr>

        <tr>
          <th>OS</th>
          <td>All
          </td>
        </tr>

        <tr>
          <th>Status</th>
          <td>UNCONFIRMED
          </td>
        </tr>

        <tr>
          <th>Severity</th>
          <td>normal
          </td>
        </tr>

        <tr>
          <th>Priority</th>
          <td>Normal
          </td>
        </tr>

        <tr>
          <th>Component</th>
          <td>ethdev
          </td>
        </tr>

        <tr>
          <th>Assignee</th>
          <td>dev&#64;dpdk.org
          </td>
        </tr>

        <tr>
          <th>Reporter</th>
          <td>stephen&#64;networkplumber.org
          </td>
        </tr>

        <tr>
          <th>Target Milestone</th>
          <td>---
          </td>
        </tr></table>
      <p>
        <div class=3D"bz_comment_block">
          <pre class=3D"bz_comment_text">Building DPDK 24.11-rc0 with gcc 1=
4 and analyzer (-fanalyzer) shows this
(wordy) error.

../drivers/net/mlx5/mlx5_flow_hw.c: In function
=E2=80=98mlx5_tbl_ensure_shared_modify_header=E2=80=99:
../drivers/net/mlx5/mlx5_flow_hw.c:2351:72: warning: dereference of NULL =
=E2=80=980=E2=80=99
[CWE-476] [-Wanalyzer-null-dereference]
 2351 |                 .sz =3D sizeof(struct mlx5_modification_cmd) *
acts-&gt;mhdr-&gt;mhdr_cmds_num
      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~^~~~~~~~~~~~~~~
  =E2=80=98mlx5_flow_hw_ctrl_flows=E2=80=99: events 1-4
    |
    |15933 | mlx5_flow_hw_ctrl_flows(struct rte_eth_dev *dev, uint32_t flag=
s)
    |      | ^~~~~~~~~~~~~~~~~~~~~~~
    |      | |
    |      | (1) entry to =E2=80=98mlx5_flow_hw_ctrl_flows=E2=80=99
    |......
    |15943 |         if (!priv-&gt;dr_ctx) {
    |      |            ~
    |      |            |
    |      |            (2) following =E2=80=98false=E2=80=99 branch...
    |......
    |15949 |         if (!priv-&gt;hw_ctrl_rx) {
    |      |            ~ ~~~~~~~~~~~~~~~~
    |      |            |     |
    |      |            |     (3) ...to here
    |      |            (4) following =E2=80=98false=E2=80=99 branch...
    |
  =E2=80=98mlx5_flow_hw_ctrl_flows=E2=80=99: event 5
    |
    |cc1:
    | (5): ...to here
    |
  =E2=80=98mlx5_flow_hw_ctrl_flows=E2=80=99: events 6-8
    |
    |15956 |         for (i =3D 0; i &lt; MLX5_FLOW_HW_CTRL_RX_ETH_PATTERN_=
MAX; ++i)
{
    |      |                     ~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                       |
    |      |                       (6) following =E2=80=98true=E2=80=99 bra=
nch (when =E2=80=98i !=3D
10=E2=80=99)...
    |......
    |15959 |                 if
(!eth_pattern_type_is_requested(eth_pattern_type, flags))
    |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                      |
    |      |                      (7) ...to here
    |      |                      (8) calling =E2=80=98eth_pattern_type_is_=
requested=E2=80=99
from =E2=80=98mlx5_flow_hw_ctrl_flows=E2=80=99
    |
    +--&gt; =E2=80=98eth_pattern_type_is_requested=E2=80=99: event 9
           |
           |15668 | eth_pattern_type_is_requested(const enum
mlx5_flow_ctrl_rx_eth_pattern_type eth_pattern_type,
           |      | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      | |
           |      | (9) entry to =E2=80=98eth_pattern_type_is_requested=E2=
=80=99
           |
         =E2=80=98eth_pattern_type_is_requested=E2=80=99: event 10
           |
           |cc1:
           | (10): following =E2=80=98true=E2=80=99 branch (when =E2=80=98e=
th_pattern_type &lt;=3D 9=E2=80=99)...
           |
         =E2=80=98eth_pattern_type_is_requested=E2=80=99: event 11
           |
           |15672 |         uint32_t vlan_flags =3D
__calc_vlan_flags(eth_pattern_type);
           |      |                               ^
           |      |                               |
           |      |                               (11) inlined call to
=E2=80=98__calc_vlan_flags=E2=80=99 from =E2=80=98eth_pattern_type_is_reque=
sted=E2=80=99
           |
           +--&gt; =E2=80=98__calc_vlan_flags=E2=80=99: events 12-13
                  |
                  |15656 |         switch (eth_pattern_type) {
                  |      |         ^~~~~~
                  |      |         |
                  |      |         (12) ...to here
                  |      |         (13) following =E2=80=98default:=E2=80=
=99 branch...
                  |
           &lt;------+
           |
         =E2=80=98eth_pattern_type_is_requested=E2=80=99: event 14
           |
           |cc1:
           | (14): ...to here
           |
         =E2=80=98eth_pattern_type_is_requested=E2=80=99: events 15-16
           |
           |15674 |         bool consider_vlan =3D vlan_flags ||
(MLX5_CTRL_VLAN_FILTER &amp; flags);
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |                                         |=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20
      |
           |      |                                         |=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20
      (16) ...to here
           |      |                                         (15) following
=E2=80=98false=E2=80=99 branch...
           |
    &lt;------+
    |
  =E2=80=98mlx5_flow_hw_ctrl_flows=E2=80=99: events 17-18
    |
    |15959 |                 if
(!eth_pattern_type_is_requested(eth_pattern_type, flags))
    |      |                    ~
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                    | |
    |      |                    | (17) returning to =E2=80=98mlx5_flow_hw_c=
trl_flows=E2=80=99
from =E2=80=98eth_pattern_type_is_requested=E2=80=99
    |      |                    (18) following =E2=80=98true=E2=80=99 branc=
h...
    |
  =E2=80=98mlx5_flow_hw_ctrl_flows=E2=80=99: event 19
    |
    |cc1:
    | (19): ...to here
    |
  =E2=80=98mlx5_flow_hw_ctrl_flows=E2=80=99: events 20-26
    |
    |15961 |                 for (j =3D 0; j &lt;
MLX5_FLOW_HW_CTRL_RX_EXPANDED_RSS_MAX; ++j) {
    |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20
~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                               |
    |      |                               (20) following =E2=80=98true=E2=
=80=99 branch (when
=E2=80=98j !=3D 7=E2=80=99)...
    |......
    |15965 |                         const struct mlx5_flow_template_table_=
cfg
cfg =3D {
    |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
~~~
    |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
|
    |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
(21) ...to here
    |......
    |15978 |                         if (!rss_type_is_requested(priv,
rss_type))
    |      |                            ~=20=20=20
    |      |                            |
    |      |                            (22) following =E2=80=98true=E2=80=
=99 branch...
    |15979 |                                 continue;
    |15980 |                         if (!tmpls-&gt;tbl) {
    |      |                            ~ ~~~~~~~~~~
    |      |                            |      |
    |      |                            |      (23) ...to here
    |      |                            (24) following =E2=80=98true=E2=80=
=99 branch...
    |15981 |                                 tmpls-&gt;tbl =3D
flow_hw_table_create(dev, &amp;cfg,
    |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                                              |
    |      |                                              (25) ...to here
    |      |                                              (26) calling
=E2=80=98flow_hw_table_create=E2=80=99 from =E2=80=98mlx5_flow_hw_ctrl_flow=
s=E2=80=99
    |15982 |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
&amp;tmpls-&gt;pt, 1, &amp;at, 1, NULL);
    |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |
    +--&gt; =E2=80=98flow_hw_table_create=E2=80=99: events 27-28
           |
           | 4978 | flow_hw_table_create(struct rte_eth_dev *dev,
           |      | ^~~~~~~~~~~~~~~~~~~~
           |      | |
           |      | (27) entry to =E2=80=98flow_hw_table_create=E2=80=99
           |......
           | 5021 |         if
(!flow_hw_validate_table_domain(&amp;attr-&gt;flow_attr)) {
           |      |            ~
           |      |            |
           |      |            (28) following =E2=80=98false=E2=80=99 branc=
h...
           |
         =E2=80=98flow_hw_table_create=E2=80=99: event 29
           |
           |cc1:
           | (29): ...to here
           |
         =E2=80=98flow_hw_table_create=E2=80=99: events 30-49
           |
           | 5026 |         for (i =3D 0; i &lt; nb_item_templates; i++) {
           |      |                     ~~^~~~~~~~~~~~~~~~~~~  ~~~
           |      |                       |                     |
           |      |                       |                     (33) ...to =
here
           |      |                       (30) following =E2=80=98true=E2=
=80=99 branch...
           | 5027 |                 const struct rte_flow_pattern_template_=
attr
*pt_attr =3D
           | 5028 |                         &amp;item_templates[i]-&gt;attr;
           |      |                                        ~
           |      |                                        |
           |      |                                        (31) ...to here
           |......
           | 5033 |                 if (!match) {
           |      |                    ~=20=20=20
           |      |                    |
           |      |                    (32) following =E2=80=98true=E2=80=
=99 branch...
           |......
           | 5040 |         for (i =3D 0; i &lt; nb_action_templates; i++) {
           |      |                     ~~~~~~~~~~~~~~~~~~~~~~~  ~~~
           |      |                       |                       |
           |      |                       |                       (37) ...to
here
           |      |                       (34) following =E2=80=98true=E2=
=80=99 branch...
           | 5041 |                 const struct rte_flow_actions_template =
*at
=3D action_templates[i];
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
                 ~
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
                 |
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
                 (35) ...to here
           |......
           | 5046 |                 if (!match) {
           |      |                    ~=20=20=20
           |      |                    |
           |      |                    (36) following =E2=80=98true=E2=80=
=99 branch...
           |......
           | 5068 |         if (nb_item_templates &gt; max_tpl ||
           |      |            ~=20=20=20=20=20=20=20=20=20=20=20
           |      |            |
           |      |            (38) following =E2=80=98false=E2=80=99 branc=
h...
           |......
           | 5080 |         tbl_mem_size +=3D nb_action_templates *
priv-&gt;nb_queue * sizeof(tbl-&gt;rule_acts[0]);
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20
~~~~~~~~~~~~~~
           |      |                                                   |
           |      |                                                   (39)
...to here
           |......
           | 5083 |         if (!tbl)
           |      |            ~=20=20=20=20=20=20=20=20=20=20=20
           |      |            |
           |      |            (40) following =E2=80=98false=E2=80=99 branc=
h (when =E2=80=98tbl=E2=80=99 is
non-NULL)...
           | 5084 |                 goto error;
           | 5085 |         tbl-&gt;cfg =3D *table_cfg;
           |      |         ~~~~~~~~~~~~~~~~~~~~~
           |      |                  |
           |      |                  (41) ...to here
           |......
           | 5088 |         if (!tbl-&gt;flow)
           |      |            ~=20=20=20=20=20=20=20=20=20=20=20
           |      |            |
           |      |            (42) following =E2=80=98false=E2=80=99 branc=
h...
           |......
           | 5092 |                                     RTE_CACHE_LINE_SIZE,
rte_dev_numa_node(dev-&gt;device));
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
               ~~~~~~~~~~~
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
                  |
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
                  (43) ...to here
           | 5093 |         if (!tbl-&gt;flow_aux)
           |      |            ~=20=20=20=20=20=20=20=20=20=20=20
           |      |            |
           |      |            (44) following =E2=80=98false=E2=80=99 branc=
h...
           |......
           | 5096 |         ge =3D mlx5_hlist_register(priv-&gt;sh-&gt;grou=
ps,
attr-&gt;flow_attr.group, &amp;ctx);
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
      |
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
      (45) ...to here
           | 5097 |         if (!ge)
           |      |            ~=20=20=20=20=20=20=20=20=20=20=20
           |      |            |
           |      |            (46) following =E2=80=98false=E2=80=99 branc=
h (when =E2=80=98ge=E2=80=99 is
non-NULL)...
           |......
           | 5100 |         tbl-&gt;grp =3D grp;
           |      |         ~~~~~~~~~~~~~~=20
           |      |                  |
           |      |                  (47) ...to here
           |......
           | 5109 |         if (attr-&gt;hash_func =3D=3D
RTE_FLOW_TABLE_HASH_FUNC_CRC16) {
           |      |            ~=20=20=20=20=20=20=20=20=20=20=20
           |      |            |
           |      |            (48) following =E2=80=98false=E2=80=99 branc=
h...
           |......
           | 5114 |         matcher_attr.distribute_mode =3D
flow_hw_matcher_distribute_mode_get(attr-&gt;hash_func);
           |      |                                        ~
           |      |                                        |
           |      |                                        (49) inlined cal=
l to
=E2=80=98flow_hw_matcher_distribute_mode_get=E2=80=99 from =E2=80=98flow_hw=
_table_create=E2=80=99
           |
           +--&gt; =E2=80=98flow_hw_matcher_distribute_mode_get=E2=80=99: e=
vent 50
                  |
                  |  481 |         if (hash_func =3D=3D
RTE_FLOW_TABLE_HASH_FUNC_LINEAR)
                  |      |            ^
                  |      |            |
                  |      |            (50) ...to here
                  |
           &lt;------+
           |
         =E2=80=98flow_hw_table_create=E2=80=99: events 51-57
           |
           | 5137 |         for (i =3D 0; i &lt; nb_item_templates; i++) {
           |      |                     ~~^~~~~~~~~~~~~~~~~~~
           |      |                       |
           |      |                       (51) following =E2=80=98true=E2=
=80=99 branch...
           |      |                       (55) following =E2=80=98false=E2=
=80=99 branch...
           |......
           | 5140 |                 if ((flow_attr.ingress &amp;&amp;
!item_templates[i]-&gt;attr.ingress) ||
           |      |                      ~~~~~~~~~~~~~~~~~
           |      |                      |
           |      |                      (52) ...to here
           |......
           | 5151 |                 if (ret &lt;=3D 1) {
           |      |                    ~=20=20=20
           |      |                    |
           |      |                    (53) following =E2=80=98false=E2=80=
=99 branch...
           |......
           | 5155 |                 mt[i] =3D item_templates[i]-&gt;mt;
           |      |                         ~~~~~~~~~~~~~~~~~
           |      |                                       |
           |      |                                       (54) ...to here
           |......
           | 5158 |         tbl-&gt;nb_item_templates =3D nb_item_templates;
           |      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |                                |
           |      |                                (56) ...to here
           | 5159 |         /* Build the action template. */
           | 5160 |         err =3D mlx5_hw_build_template_table(dev,
nb_action_templates,
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |               |
           |      |               (57) calling =E2=80=98mlx5_hw_build_templ=
ate_table=E2=80=99
from =E2=80=98flow_hw_table_create=E2=80=99
           | 5161 |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
action_templates, at, tbl, &amp;sub_error);
           |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |
           +--&gt; =E2=80=98mlx5_hw_build_template_table=E2=80=99: events 5=
8-59
                  |
                  | 4876 | mlx5_hw_build_template_table(struct rte_eth_dev
*dev,
                  |      | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
                  |      | |
                  |      | (58) entry to =E2=80=98mlx5_hw_build_template_ta=
ble=E2=80=99
                  |......
                  | 4886 |         for (i =3D 0; i &lt; nb_action_templates=
; i++) {
                  |      |                     ~~~~~~~~~~~~~~~~~~~~~~~
                  |      |                       |
                  |      |                       (59) following =E2=80=98tr=
ue=E2=80=99 branch
(when =E2=80=98i &lt; nb_action_templates=E2=80=99)...
                  |
                =E2=80=98mlx5_hw_build_template_table=E2=80=99: event 60
                  |
                  | 4887 |                 uint32_t refcnt =3D
rte_atomic_fetch_add_explicit(&amp;action_templates[i]-&gt;refcnt, 1,
                  |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20
                            ^
                  |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20
                            |
                  |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20
                            (60) ...to here
../lib/eal/include/rte_stdatomic.h:159:28: note: in definition of macro
=E2=80=98rte_atomic_fetch_add_explicit=E2=80=99
                  |  159 |         __atomic_fetch_add(ptr, val, memorder)
                  |      |                            ^~~
                  |
                =E2=80=98mlx5_hw_build_template_table=E2=80=99: events 61-65
                  |
                  |../drivers/net/mlx5/mlx5_flow_hw.c:4890:20:
                  | 4890 |                 if (refcnt &lt;=3D 1) {
                  |      |                    ^
                  |      |                    |
                  |      |                    (61) following =E2=80=98false=
=E2=80=99 branch...
                  |......
                  | 4896 |                 at[i] =3D action_templates[i]-&g=
t;tmpl;
                  |      |                         ~~~~~~~~~~~~~~~~~~~
                  |      |                                         |
                  |      |                                         (62) ...=
to
here
                  |......
                  | 4900 |                 if (!dev-&gt;data-&gt;dev_starte=
d)
                  |      |                    ~
                  |      |                    |
                  |      |                    (63) following =E2=80=98false=
=E2=80=99 branch...
                  | 4901 |                         continue;
                  | 4902 |                 ret =3D
flow_hw_translate_actions_template(dev, &amp;tbl-&gt;cfg,
                  |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                  |      |                       |
                  |      |                       (64) ...to here
                  |      |                       (65) inlined call to
=E2=80=98flow_hw_translate_actions_template=E2=80=99 from =E2=80=98mlx5_hw_=
build_template_table=E2=80=99
                  | 4903 |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20
&amp;tbl-&gt;ats[i].acts,
                  |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~
                  | 4904 |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20
action_templates[i],
                  |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~
                  | 4905 |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20
&amp;tbl-&gt;mpctx, error);
                  |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~
                  |
                  +--&gt; =E2=80=98flow_hw_translate_actions_template=E2=80=
=99: event 66
                         |
                         | 2977 |         return
__flow_hw_translate_actions_template(dev, cfg, acts, at, mp_ctx, false, err=
or);
                         |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=
~~~
                         |      |                |
                         |      |                (66) calling
=E2=80=98__flow_hw_translate_actions_template=E2=80=99 from =E2=80=98mlx5_h=
w_build_template_table=E2=80=99
                         |
                       =E2=80=98__flow_hw_translate_actions_template=E2=80=
=99: events 67-74
                         |
                         | 2468 | __flow_hw_translate_actions_template(stru=
ct
rte_eth_dev *dev,
                         |      | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                         |      | |
                         |      | (67) entry to
=E2=80=98__flow_hw_translate_actions_template=E2=80=99
                         |......
                         | 2510 |         for (; !actions_end; actions++,
masks++) {
                         |      |                ~~~~~~~~~~~~
                         |      |                |
                         |      |                (68) following =E2=80=98fa=
lse=E2=80=99 branch
(when =E2=80=98actions_end =3D=3D 0=E2=80=99)...
                         |      |                (70) following =E2=80=98tr=
ue=E2=80=99 branch
(when =E2=80=98actions_end !=3D 0=E2=80=99)...
                         | 2511 |                 uint64_t pos =3D actions -
at-&gt;actions;
                         |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20
~~~~~~~~~~~
                         |      |                                          =
  |
                         |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20
(69) ...to here
                         |......
                         | 2899 |         if (mhdr.pos !=3D UINT16_MAX) {
                         |      |            ~~~~~~~~~
                         |      |            |    |
                         |      |            |    (71) ...to here
                         |      |            (72) following =E2=80=98true=
=E2=80=99 branch...
                         | 2900 |                 ret =3D
mlx5_tbl_translate_modify_header(dev, cfg, acts, mp_ctx, &amp;mhdr, error);
                         |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                         |      |                       |
                         |      |                       (73) ...to here
                         |      |                       (74) calling
=E2=80=98mlx5_tbl_translate_modify_header=E2=80=99 from =E2=80=98__flow_hw_=
translate_actions_template=E2=80=99
                         |
                         +--&gt; =E2=80=98mlx5_tbl_translate_modify_header=
=E2=80=99: events 75-76
                                |
                                | 2305 |
mlx5_tbl_translate_modify_header(struct rte_eth_dev *dev,
                                |      | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                |      | |
                                |      | (75) entry to
=E2=80=98mlx5_tbl_translate_modify_header=E2=80=99
                                |......
                                | 2317 |         if
(flow_hw_validate_compiled_modify_field(dev, cfg, mhdr, error)) {
                                |      |=20=20=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                |      |             |
                                |      |             (76) calling
=E2=80=98flow_hw_validate_compiled_modify_field=E2=80=99 from
=E2=80=98mlx5_tbl_translate_modify_header=E2=80=99
                                |
                                +--&gt; =E2=80=98flow_hw_validate_compiled_=
modify_field=E2=80=99:
events 77-81
                                       |
                                       | 1662 |
flow_hw_validate_compiled_modify_field(struct rte_eth_dev *dev,
                                       |      |
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                       |      | |
                                       |      | (77) entry to
=E2=80=98flow_hw_validate_compiled_modify_field=E2=80=99
                                       |......
                                       | 1675 |         if
(cfg-&gt;attr.flow_attr.group !=3D 0 &amp;&amp;
                                       |      |=20=20=20=20=20=20=20=20=20=
=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                       |      |            |=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20
           |
                                       |      |            |=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20
           (80) following =E2=80=98true=E2=80=99 branch...
                                       |      |            (78) following
=E2=80=98true=E2=80=99 branch...
                                       | 1676 |             mhdr-&gt;mhdr_c=
mds_num
<span class=3D"quote">&gt; hca_attr-&gt;max_header_modify_pattern_length) {=
</span >
                                       |      |=20=20=20=20=20=20=20=20=20=
=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                       |      |                 |
                                       |      |                 (79) ...to =
here
                                       | 1677 |                 uint32_t no=
ps =3D
flow_hw_count_nop_modify_field(mhdr);
                                       |      |=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                       |      |=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
|
                                       |      |=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
(81) ...to here
                                       |
                                &lt;------+
                                |
                              =E2=80=98mlx5_tbl_translate_modify_header=E2=
=80=99: events 82-85
                                |
                                | 2317 |         if
(flow_hw_validate_compiled_modify_field(dev, cfg, mhdr, error)) {
                                |      |=20=20=20=20=20=20=20=20=20=20=20
~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                |      |            ||
                                |      |            |(82) returning to
=E2=80=98mlx5_tbl_translate_modify_header=E2=80=99 from
=E2=80=98flow_hw_validate_compiled_modify_field=E2=80=99
                                |      |            (83) following =E2=80=
=98true=E2=80=99
branch...
                                | 2318 |=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20
__flow_hw_action_template_destroy(dev, acts);
                                |      |=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                |      |                 |
                                |      |                 (84) ...to here
                                |      |                 (85) calling
=E2=80=98__flow_hw_action_template_destroy=E2=80=99 from =E2=80=98mlx5_tbl_=
translate_modify_header=E2=80=99
                                |
                                +--&gt; =E2=80=98__flow_hw_action_template_=
destroy=E2=80=99:
events 86-87
                                       |
                                       |  943 |
__flow_hw_action_template_destroy(struct rte_eth_dev *dev, struct
mlx5_hw_actions *acts)
                                       |      |
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                       |      | |
                                       |      | (86) entry to
=E2=80=98__flow_hw_action_template_destroy=E2=80=99
                                       |......
                                       |  954 |=20=20=20=20=20=20=20=20
__flow_hw_actions_release(dev, acts);
                                       |      |=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                       |      |         |
                                       |      |         (87) calling
=E2=80=98__flow_hw_actions_release=E2=80=99 from =E2=80=98__flow_hw_action_=
template_destroy=E2=80=99
                                       |
                                       +--&gt; =E2=80=98__flow_hw_actions_r=
elease=E2=80=99: events
88-90
                                              |
                                              |  884 |
__flow_hw_actions_release(struct rte_eth_dev *dev, struct mlx5_hw_actions
*acts)
                                              |      |
^~~~~~~~~~~~~~~~~~~~~~~~~
                                              |      | |
                                              |      | (88) entry to
=E2=80=98__flow_hw_actions_release=E2=80=99
                                              |......
                                              |  916 |         if (acts-&gt=
;mhdr)
{
                                              |      |            ~
                                              |      |            |
                                              |      |            (89)
following =E2=80=98true=E2=80=99 branch...
                                              |  917 |=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20
flow_hw_template_destroy_mhdr_action(acts-&gt;mhdr);
                                              |      |                 ~
                                              |      |                 |
                                              |      |                 (90)
inlined call to =E2=80=98flow_hw_template_destroy_mhdr_action=E2=80=99 from
=E2=80=98__flow_hw_actions_release=E2=80=99
                                              |
                                              +--&gt;
=E2=80=98flow_hw_template_destroy_mhdr_action=E2=80=99: event 91
                                                     |
                                                     |  868 |         if
(mhdr-&gt;action &amp;&amp; !mhdr-&gt;multi_pattern)
                                                     |      |=20=20=20=20=
=20=20=20=20=20=20=20=20
~~~~^~~~~~~~
                                                     |      |              =
   |
                                                     |      |=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20
(91) ...to here
                                                     |
                                              &lt;------+
                                              |
                                            =E2=80=98__flow_hw_actions_rele=
ase=E2=80=99: events
92-96
                                              |
                                              |  919 |=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20
acts-&gt;mhdr =3D NULL;
                                              |      |=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
  ^
                                              |      |=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
  |
                                              |      |=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
  (92) =E2=80=980=E2=80=99 is NULL
                                              |  920 |         }
                                              |  921 |         if
(mlx5_hws_cnt_id_valid(acts-&gt;cnt_id)) {
                                              |      |            ~=20=20=
=20=20=20=20=20=20=20=20=20=20=20
                                              |      |            |
                                              |      |            (93)
following =E2=80=98false=E2=80=99 branch...
                                              |......
                                              |  925 |         if
(acts-&gt;mtr_id) {
                                              |      |            ~~~~~~~~~=
~~~~=20
                                              |      |            |    |
                                              |      |            |    (94)
...to here
                                              |      |            (95)
following =E2=80=98false=E2=80=99 branch...
                                              |......
                                              |  929 | }
                                              |      | ~=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
                                              |      | |
                                              |      | (96) ...to here
                                              |
                                       &lt;------+
                                       |
                                     =E2=80=98__flow_hw_action_template_des=
troy=E2=80=99: event
97
                                       |
                                       |  954 |=20=20=20=20=20=20=20=20
__flow_hw_actions_release(dev, acts);
                                       |      |=20=20=20=20=20=20=20=20
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                       |      |         |
                                       |      |         (97) returning to
=E2=80=98__flow_hw_action_template_destroy=E2=80=99 from =E2=80=98__flow_hw=
_actions_release=E2=80=99
                                       |
                                &lt;------+
                                |
                              =E2=80=98mlx5_tbl_translate_modify_header=E2=
=80=99: event 98
                                |
                                | 2318 |=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20
__flow_hw_action_template_destroy(dev, acts);
                                |      |=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                |      |                 |
                                |      |                 (98) returning to
=E2=80=98mlx5_tbl_translate_modify_header=E2=80=99 from =E2=80=98__flow_hw_=
action_template_destroy=E2=80=99
                                |
                         &lt;------+
                         |
                       =E2=80=98__flow_hw_translate_actions_template=E2=80=
=99: events 99-106
                         |
                         | 2900 |                 ret =3D
mlx5_tbl_translate_modify_header(dev, cfg, acts, mp_ctx, &amp;mhdr, error);
                         |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                         |      |                       |
                         |      |                       (99) returning to
=E2=80=98__flow_hw_translate_actions_template=E2=80=99 from =E2=80=98mlx5_t=
bl_translate_modify_header=E2=80=99
                         | 2901 |                 if (ret)
                         |      |                    ~=20=20=20
                         |      |                    |
                         |      |                    (100) following =E2=80=
=98false=E2=80=99
branch (when =E2=80=98ret =3D=3D 0=E2=80=99)...
                         | 2902 |                         goto err;
                         | 2903 |                 if (!nt_mode &amp;&amp; m=
hdr.shared)
{
                         |      |                    ~~~~~~~~~~~~~~~~~~~~~~=
~~
                         |      |                    |         |
                         |      |                    |         (103) ...to =
here
                         |      |                    |         (104) follow=
ing
=E2=80=98true=E2=80=99 branch...
                         |      |                    (101) ...to here
                         |      |                    (102) following =E2=80=
=98false=E2=80=99
branch (when =E2=80=98nt_mode =3D=3D 0=E2=80=99)...
                         | 2904 |                         ret =3D
mlx5_tbl_ensure_shared_modify_header(dev, cfg, acts, error);
                         |      |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                         |      |                               |
                         |      |                               (105) ...to
here
                         |      |                               (106) calli=
ng
=E2=80=98mlx5_tbl_ensure_shared_modify_header=E2=80=99 from
=E2=80=98__flow_hw_translate_actions_template=E2=80=99
                         |
                         +--&gt; =E2=80=98mlx5_tbl_ensure_shared_modify_hea=
der=E2=80=99: events
107-109
                                |
                                | 2341 |
mlx5_tbl_ensure_shared_modify_header(struct rte_eth_dev *dev,
                                |      | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=
~~
                                |      | |
                                |      | (107) entry to
=E2=80=98mlx5_tbl_ensure_shared_modify_header=E2=80=99
                                |......
                                | 2351 |                 .sz =3D sizeof(str=
uct
mlx5_modification_cmd) * acts-&gt;mhdr-&gt;mhdr_cmds_num
                                |      |=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20
                      ~~~~~~~~~~~~~~~~~~~~~~~~~
                                |      |=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20
                          |     |
                                |      |=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20
                          |     (109) dereference of NULL =E2=80=98*acts.mh=
dr=E2=80=99
                                |      |=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20
                          (108) =E2=80=980=E2=80=99 is NULL
                                |
          </pre>
        </div>
      </p>


      <hr>
      <span>You are receiving this mail because:</span>

      <ul>
          <li>You are the assignee for the bug.</li>
      </ul>
      <div itemscope itemtype=3D"http://schema.org/EmailMessage">
        <div itemprop=3D"action" itemscope itemtype=3D"http://schema.org/Vi=
ewAction">
=20=20=20=20=20=20=20=20=20=20
          <link itemprop=3D"url" href=3D"https://bugs.dpdk.org/show_bug.cgi=
?id=3D1521">
          <meta itemprop=3D"name" content=3D"View bug">
        </div>
        <meta itemprop=3D"description" content=3D"Bugzilla bug update notif=
ication">
      </div>
    </body>
</html>=

--17236026310.60917.3990773--