[PATCH v5 00/19] net/tap: cleanups, bug fixes, and VLA removal

Stephen Hemminger
2026-02-22T17:32:32Z

Patches 1-2 are documentation and bug fixes that stand alone: update
the features matrix to match current driver capabilities, and fix
queue statistics to count all queues regardless of the queue stat
counter limit.

Patch 3 fixes interface name buffers to use IFNAMSIZ instead of
RTE_ETH_NAME_MAX_LEN, since these are Linux kernel interface names
not DPDK device names.

Patches 4-6 are minor cleanups: replace the runtime speed capability
function with a compile-time constant (TAP is always 10G), clarify
TUN/TAP flag operator precedence with parentheses, and extend the
fixed MAC index to 16 bits to avoid duplicates after 256 hot-plug
cycles.

Patches 7-12 fix bugs tagged for stable: a bounds check to prevent
an out-of-bounds read on truncated L4 headers; resource leaks in
the primary and secondary process probe error paths; a missing free
of the IPC reply buffer on queue count mismatch; a use-after-free
with an orphaned kernel TC rule when remote flow creation fails; and
a leaked remote_flow allocation on EEXIST from an implicit rule.

Patches 13-18 restructure the driver internals: dynamically allocate
queue structures instead of embedding fixed-size arrays in
pmd_internals; replace the pointer-to-VLA iovec with a flexible
array member sized from MTU and mbuf geometry; replace the Tx
per-packet VLA with a fixed-size stack array capped at 128 segments;
remove the VLA in flow item validation; consolidate per-queue
statistics into a common structure; and enable -Wvla warnings.

Patch 19 adds a unit test suite for the TAP PMD covering
configuration, link, stats, MTU, MAC, promisc, allmulti, queue
start/stop, link up/down, stop/start, and multi-queue.

v5 - use IFNAMSIZ for interface name buffers
- dynamically allocate queue structures
- compute Rx scatter segments from MTU instead of nb_rx_desc
- use flex array for Rx iovecs, fixed stack array for Tx
- consolidate queue statistics

Stephen Hemminger (19):
net/tap: fix handling of queue stats
doc: update tap features
net/tap: use correct length for interface names
net/tap: replace runtime speed capability with constant
net/tap: clarify TUN/TAP flag assignment
net/tap: extend fixed MAC range to 16 bits
net/tap: skip checksum on truncated L4 headers
net/tap: fix resource leaks in tap create error path
net/tap: fix resource leaks in secondary process probe
net/tap: free IPC reply buffer on queue count mismatch
net/tap: fix use-after-free on remote flow creation failure
net/tap: free remote flow when implicit rule already exists
net/tap: dynamically allocate queue structures
net/tap: remove VLA in flow item validation
net/tap: fix Rx descriptor vs scatter segment confusion
net/tap: replace use of VLA in transmit burst
net/tap: consolidate queue statistics
net/tap: enable VLA warnings
test: add unit tests for TAP PMD

app/test/meson.build | 1 +
app/test/test_pmd_tap.c | 1143 ++++++++++++++++++++++++++++++
doc/guides/nics/features/tap.ini | 14 +-
drivers/net/tap/meson.build | 1 -
drivers/net/tap/rte_eth_tap.c | 411 ++++++-----
drivers/net/tap/rte_eth_tap.h | 28 +-
drivers/net/tap/tap_flow.c | 36 +-
7 files changed, 1424 insertions(+), 210 deletions(-)
create mode 100644 app/test/test_pmd_tap.c

--
2.51.0