Re: [PATCH dpdk] net/tap: fix interrupt callback crash after failed start

[Stephen Hemminger <stephen@networkplumber.org>]

On Fri, 17 Oct 2025 14:19:47 +0200
Robin Jarry <rjarry@redhat.com> wrote:

> After moving a tap linux net device to a different namespace,
> tap_link_set_up fails with an -ENODEV error. Indeed it relies on an
> ioctl call using the interface name as argument:
> 
> 	/* with ifr->ifrn_name = "dtapX" */
> 	ioctl(pmd->ioctl_sock, SIOCGIFFLAGS, ifr)
> 
> This causes rte_eth_dev_stop() to do nothing since the device is not
> seen as started. And then, when removing the device, the interrupt
> callbacks are left there.
> 
> If they are invoked, they will be so with a "freed" device pointer:
> 
> Thread 2 "dpdk-intr" hit Breakpoint 1, tap_dev_intr_handler
>     at ../drivers/net/tap/rte_eth_tap.c:1689
> 1689            struct pmd_internals *pmd = dev->data->dev_private;
> (gdb) p *dev
> $2 = {
>   ...
>   data = 0x0,
>   ...
>   state = RTE_ETH_DEV_UNUSED,
>   security_ctx = 0x0
> }
> 
> This causes a crash when dereferencing the data pointer.
> 
> When tap_link_set_up fails, ensure to unregister the interrupt callbacks
> that were just reinstalled.
> 
> Cc: stable@dpdk.org
> Fixes: c0bddd3a057f ("net/tap: add link status notification")
> 
> Signed-off-by: Robin Jarry <rjarry@redhat.com>

Queued to next-net