Re: [PATCH v5 00/19] net/tap: cleanups, bug fixes, and VLA removal

Stephen Hemminger
2026-02-25T23:19:05Z

On Sun, 22 Feb 2026 09:30:35 -0800
Stephen Hemminger <stephen@networkplumber.org> wrote:

> Patches 1-2 are documentation and bug fixes that stand alone: update
> the features matrix to match current driver capabilities, and fix
> queue statistics to count all queues regardless of the queue stat
> counter limit.
>
> Patch 3 fixes interface name buffers to use IFNAMSIZ instead of
> RTE_ETH_NAME_MAX_LEN, since these are Linux kernel interface names
> not DPDK device names.
>
> Patches 4-6 are minor cleanups: replace the runtime speed capability
> function with a compile-time constant (TAP is always 10G), clarify
> TUN/TAP flag operator precedence with parentheses, and extend the
> fixed MAC index to 16 bits to avoid duplicates after 256 hot-plug
> cycles.
>
> Patches 7-12 fix bugs tagged for stable: a bounds check to prevent
> an out-of-bounds read on truncated L4 headers; resource leaks in
> the primary and secondary process probe error paths; a missing free
> of the IPC reply buffer on queue count mismatch; a use-after-free
> with an orphaned kernel TC rule when remote flow creation fails; and
> a leaked remote_flow allocation on EEXIST from an implicit rule.
>
> Patches 13-18 restructure the driver internals: dynamically allocate
> queue structures instead of embedding fixed-size arrays in
> pmd_internals; replace the pointer-to-VLA iovec with a flexible
> array member sized from MTU and mbuf geometry; replace the Tx
> per-packet VLA with a fixed-size stack array capped at 128 segments;
> remove the VLA in flow item validation; consolidate per-queue
> statistics into a common structure; and enable -Wvla warnings.
>
> Patch 19 adds a unit test suite for the TAP PMD covering
> configuration, link, stats, MTU, MAC, promisc, allmulti, queue
> start/stop, link up/down, stop/start, and multi-queue.
>
> v5 - use IFNAMSIZ for interface name buffers
> - dynamically allocate queue structures
> - compute Rx scatter segments from MTU instead of nb_rx_desc
> - use flex array for Rx iovecs, fixed stack array for Tx
> - consolidate queue statistics
>
>
> Stephen Hemminger (19):
> net/tap: fix handling of queue stats
> doc: update tap features
> net/tap: use correct length for interface names
> net/tap: replace runtime speed capability with constant
> net/tap: clarify TUN/TAP flag assignment
> net/tap: extend fixed MAC range to 16 bits
> net/tap: skip checksum on truncated L4 headers
> net/tap: fix resource leaks in tap create error path
> net/tap: fix resource leaks in secondary process probe
> net/tap: free IPC reply buffer on queue count mismatch
> net/tap: fix use-after-free on remote flow creation failure
> net/tap: free remote flow when implicit rule already exists
> net/tap: dynamically allocate queue structures
> net/tap: remove VLA in flow item validation
> net/tap: fix Rx descriptor vs scatter segment confusion
> net/tap: replace use of VLA in transmit burst
> net/tap: consolidate queue statistics
> net/tap: enable VLA warnings
> test: add unit tests for TAP PMD
>
> app/test/meson.build | 1 +
> app/test/test_pmd_tap.c | 1143 ++++++++++++++++++++++++++++++
> doc/guides/nics/features/tap.ini | 14 +-
> drivers/net/tap/meson.build | 1 -
> drivers/net/tap/rte_eth_tap.c | 411 ++++++-----
> drivers/net/tap/rte_eth_tap.h | 28 +-
> drivers/net/tap/tap_flow.c | 36 +-
> 7 files changed, 1424 insertions(+), 210 deletions(-)
> create mode 100644 app/test/test_pmd_tap.c
>

Applied to next-net.