[PATCH v4 07/10] net/tap: free IPC reply buffer on queue count mismatch

Stephen Hemminger
2026-02-20T17:07:12Z

In tap_mp_attach_queues(), if the reply queue count does not match
the number of received file descriptors, the function returns -1
without freeing the reply buffer allocated by rte_mp_request_sync().
Add the missing free().

Bugzilla ID: 1881
Fixes: 9ad43ad8fbee ("net/tap: fix potential IPC buffer overrun")
Cc: stable@dpdk.org

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
drivers/net/tap/rte_eth_tap.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/net/tap/rte_eth_tap.c b/drivers/net/tap/rte_eth_tap.c
index 974b45ecad..deb1d72382 100644
--- a/drivers/net/tap/rte_eth_tap.c
+++ b/drivers/net/tap/rte_eth_tap.c
@@ -2407,6 +2407,7 @@ tap_mp_attach_queues(const char *port_name, struct rte_eth_dev *dev)
/* Attach the queues from received file descriptors */
if (reply_param->q_count != reply->num_fds) {
TAP_LOG(ERR, "Unexpected number of fds received");
+ free(reply);
return -1;
}

--
2.51.0