Re: [PATCH v2] net/memif: fix use after free on listener socket close

[Stephen Hemminger <stephen@networkplumber.org>]

On Tue, 10 Nov 2026 08:43:28 +0100
David Marchand <david.marchand@redhat.com> wrote:

> On Mon, 9 Nov 2026 at 23:14, Stephen Hemminger
> <stephen@networkplumber.org> wrote:
> >
> > On Fri,  6 Nov 2026 15:57:29 +0100
> > David Marchand <david.marchand@redhat.com> wrote:
> >  
> > > memif_socket_remove_device() calls rte_intr_callback_unregister() on
> > > the listener socket interrupt handle. If memif_listener_handler() is
> > > active at that point, the unregister returns -EAGAIN and the code
> > > proceeds to close and free the handle while the handler is still
> > > running.
> > >
> > > Use rte_intr_callback_unregister_sync() which retries until the
> > > handler completes.
> > >
> > > Fixes: 7281511c2cfa ("net/memif: fix some interrupt FD leaks")
> > >
> > > Signed-off-by: David Marchand <david.marchand@redhat.com>
> > > Reviewed-by: Stephen Hemminger <stephen@networkplumber.org>
> > > ---
> > > Changes since v1:
> > > - added missing _sync in other call,  
> >
> >
> > Applied to next-net but dropped the Fixes line since that commit
> > is after the last release. Fixes is not necessary during the merge
> > cycle.  
> 
> I disagree.
> 
> Fixes: tag are not *only* for backport purpose.
> Those tags also give useful information when looking back in git
> history, to understand why change X is done.

Makes sense, just don't cc stable