[PATCH] eal: add destructor to unregister tailq on unload

[PATCH] eal: add destructor to unregister tailq on unload

[Stephen Hemminger]

Libraries that use EAL_REGISTER_TAILQ insert a pointer to a static
struct rte_tailq_elem into the process-local tailq list via a
constructor, but have no matching destructor. When such a library
is loaded as a dependency of a plugin via dlopen() and later
unloaded via dlclose(), the list retains a dangling pointer to the
now-unmapped static. Reloading the plugin crashes in
rte_eal_tailq_local_register() when it traverses the stale entry.

Add rte_eal_tailq_unregister() and extend the EAL_REGISTER_TAILQ
macro to emit an RTE_FINI destructor alongside the existing
RTE_INIT constructor. Every library that uses the macro
automatically gets both sides; no per-library changes are needed.

Bugzilla ID: 1081
Fixes: 873a61c7526b ("tailq: introduce dynamic register system")
Cc: stable@dpdk.org

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
 lib/eal/common/eal_common_tailqs.c |  8 ++++++++
 lib/eal/include/rte_tailq.h        | 17 +++++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/lib/eal/common/eal_common_tailqs.c b/lib/eal/common/eal_common_tailqs.c
index c581f43b6f..714f91d0ec 100644
--- a/lib/eal/common/eal_common_tailqs.c
+++ b/lib/eal/common/eal_common_tailqs.c
@@ -148,6 +148,14 @@ rte_eal_tailq_register(struct rte_tailq_elem *t)
 	return -1;
 }
 
+RTE_EXPORT_SYMBOL(rte_eal_tailq_unregister)
+void
+rte_eal_tailq_unregister(struct rte_tailq_elem *t)
+{
+	TAILQ_REMOVE(&rte_tailq_elem_head, t, next);
+	t->head = NULL;
+}
+
 int
 rte_eal_tailqs_init(void)
 {
diff --git a/lib/eal/include/rte_tailq.h b/lib/eal/include/rte_tailq.h
index e7caed6812..c5d5cb782f 100644
--- a/lib/eal/include/rte_tailq.h
+++ b/lib/eal/include/rte_tailq.h
@@ -117,11 +117,28 @@ struct rte_tailq_head *rte_eal_tailq_lookup(const char *name);
  */
 int rte_eal_tailq_register(struct rte_tailq_elem *t);
 
+/**
+ * Remove a tail queue element from the local list.
+ * This function is mainly used for EAL_REGISTER_TAILQ macro which pairs
+ * an RTE_FINI destructor with the existing RTE_INIT constructor.
+ * The destructor calls this function during dlclose() to prevent
+ * dangling pointers to unmapped library data.
+ *
+ * @param t
+ *   The tailq element which contains the name of the tailq you want to
+ *   delete
+ */
+void rte_eal_tailq_unregister(struct rte_tailq_elem *t);
+
 #define EAL_REGISTER_TAILQ(t) \
 RTE_INIT(tailqinitfn_ ##t) \
 { \
 	if (rte_eal_tailq_register(&t) < 0) \
 		rte_panic("Cannot initialize tailq: %s\n", t.name); \
+} \
+RTE_FINI(tailqfinifn_ ##t) \
+{ \
+	rte_eal_tailq_unregister(&t); \
 }
 
 /* This macro permits both remove and free var within the loop safely.*/
-- 
2.53.0

Re: [PATCH] eal: add destructor to unregister tailq on unload

[Bruce Richardson]

On Sun, Jun 07, 2026 at 08:04:17AM -0700, Stephen Hemminger wrote:
> Libraries that use EAL_REGISTER_TAILQ insert a pointer to a static
> struct rte_tailq_elem into the process-local tailq list via a
> constructor, but have no matching destructor. When such a library
> is loaded as a dependency of a plugin via dlopen() and later
> unloaded via dlclose(), the list retains a dangling pointer to the
> now-unmapped static. Reloading the plugin crashes in
> rte_eal_tailq_local_register() when it traverses the stale entry.
> 
> Add rte_eal_tailq_unregister() and extend the EAL_REGISTER_TAILQ
> macro to emit an RTE_FINI destructor alongside the existing
> RTE_INIT constructor. Every library that uses the macro
> automatically gets both sides; no per-library changes are needed.
> 
> Bugzilla ID: 1081
> Fixes: 873a61c7526b ("tailq: introduce dynamic register system")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
> ---
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Re: [PATCH] eal: add destructor to unregister tailq on unload

[David Marchand]

On Sun, 7 Jun 2026 at 17:04, Stephen Hemminger
<stephen@networkplumber.org> wrote:
>
> Libraries that use EAL_REGISTER_TAILQ insert a pointer to a static
> struct rte_tailq_elem into the process-local tailq list via a
> constructor, but have no matching destructor. When such a library
> is loaded as a dependency of a plugin via dlopen() and later
> unloaded via dlclose(), the list retains a dangling pointer to the
> now-unmapped static. Reloading the plugin crashes in
> rte_eal_tailq_local_register() when it traverses the stale entry.
>
> Add rte_eal_tailq_unregister() and extend the EAL_REGISTER_TAILQ
> macro to emit an RTE_FINI destructor alongside the existing
> RTE_INIT constructor. Every library that uses the macro
> automatically gets both sides; no per-library changes are needed.
>
> Bugzilla ID: 1081
> Fixes: 873a61c7526b ("tailq: introduce dynamic register system")
> Cc: stable@dpdk.org
>
> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
> ---
>  lib/eal/common/eal_common_tailqs.c |  8 ++++++++
>  lib/eal/include/rte_tailq.h        | 17 +++++++++++++++++
>  2 files changed, 25 insertions(+)
>
> diff --git a/lib/eal/common/eal_common_tailqs.c b/lib/eal/common/eal_common_tailqs.c
> index c581f43b6f..714f91d0ec 100644
> --- a/lib/eal/common/eal_common_tailqs.c
> +++ b/lib/eal/common/eal_common_tailqs.c
> @@ -148,6 +148,14 @@ rte_eal_tailq_register(struct rte_tailq_elem *t)
>         return -1;
>  }
>
> +RTE_EXPORT_SYMBOL(rte_eal_tailq_unregister)
> +void
> +rte_eal_tailq_unregister(struct rte_tailq_elem *t)
> +{
> +       TAILQ_REMOVE(&rte_tailq_elem_head, t, next);
> +       t->head = NULL;
> +}

This cleans up the local storage which is good, but it leaves an entry
reserved in the mcfg->tailq_head[] array.


-- 
David Marchand

[PATCH v2] eal: add destructor to unregister tailq on unload

[Stephen Hemminger]

EAL_REGISTER_TAILQ registers a static rte_tailq_elem from a
constructor but provides no destructor. If a library using the
macro is loaded with dlopen() and later unloaded with dlclose(),
the process-local list keeps a dangling pointer to the unmapped
elem, and the next dlopen() crashes in rte_eal_tailq_local_register()
while walking the list.

Add a new RTE_FINI destructor that is paired with the constructor
in the macro. rte_eal_tailq_unregister() drops the local entry on
unload. The shared mcfg->tailq_head[] slot is left reserved since
it is keyed by name and shared between processes;
rte_eal_tailq_update() now reattaches to that slot on re-register
instead of failing.

Bugzilla ID: 1081
Fixes: 873a61c7526b ("tailq: introduce dynamic register system")
Cc: stable@dpdk.org

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>
---
v2 - cover the case where name still is reserved

 lib/eal/common/eal_common_tailqs.c | 13 +++++++++++++
 lib/eal/include/rte_tailq.h        | 16 ++++++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/lib/eal/common/eal_common_tailqs.c b/lib/eal/common/eal_common_tailqs.c
index c581f43b6f..9355c108f2 100644
--- a/lib/eal/common/eal_common_tailqs.c
+++ b/lib/eal/common/eal_common_tailqs.c
@@ -113,6 +113,11 @@ rte_eal_tailq_update(struct rte_tailq_elem *t)
 	if (rte_eal_process_type() == RTE_PROC_PRIMARY) {
 		/* primary process is the only one that creates */
 		t->head = rte_eal_tailq_create(t->name);
+
+		if (t->head == NULL) {
+			/* slot reserved by an earlier load -- reuse it */
+			t->head = rte_eal_tailq_lookup(t->name);
+		}
 	} else {
 		t->head = rte_eal_tailq_lookup(t->name);
 	}
@@ -148,6 +153,14 @@ rte_eal_tailq_register(struct rte_tailq_elem *t)
 	return -1;
 }
 
+RTE_EXPORT_SYMBOL(rte_eal_tailq_unregister)
+void
+rte_eal_tailq_unregister(struct rte_tailq_elem *t)
+{
+	TAILQ_REMOVE(&rte_tailq_elem_head, t, next);
+	t->head = NULL;
+}
+
 int
 rte_eal_tailqs_init(void)
 {
diff --git a/lib/eal/include/rte_tailq.h b/lib/eal/include/rte_tailq.h
index e7caed6812..d4d8bfd6d4 100644
--- a/lib/eal/include/rte_tailq.h
+++ b/lib/eal/include/rte_tailq.h
@@ -117,11 +117,27 @@ struct rte_tailq_head *rte_eal_tailq_lookup(const char *name);
  */
 int rte_eal_tailq_register(struct rte_tailq_elem *t);
 
+/**
+ * Remove a tail queue element from the local list.
+ * This function is mainly used for EAL_REGISTER_TAILQ macro which pairs
+ * an RTE_FINI destructor with the existing RTE_INIT constructor.
+ * The destructor calls this function during dlclose() to prevent
+ * dangling pointers to unmapped library data.
+ *
+ * @param t
+ *   The tailq element to remove from the EAL tailq list.
+ */
+void rte_eal_tailq_unregister(struct rte_tailq_elem *t);
+
 #define EAL_REGISTER_TAILQ(t) \
 RTE_INIT(tailqinitfn_ ##t) \
 { \
 	if (rte_eal_tailq_register(&t) < 0) \
 		rte_panic("Cannot initialize tailq: %s\n", t.name); \
+} \
+RTE_FINI(tailqfinifn_ ##t) \
+{ \
+	rte_eal_tailq_unregister(&t); \
 }
 
 /* This macro permits both remove and free var within the loop safely.*/
-- 
2.53.0

[PATCH v3 0/2] eal: tailq fixes

[Stephen Hemminger]

A couple of small fixes to EAL tailq

Stephen Hemminger (2):
  eal: fix off by one in in tailq name init
  eal: add destructor to unregister tailq on unload

 lib/eal/common/eal_common_tailqs.c | 15 ++++++++++++++-
 lib/eal/include/rte_tailq.h        | 16 ++++++++++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)

-- 
2.53.0

[PATCH v3 1/2] eal: fix off by one in in tailq name init

[Stephen Hemminger]

The tailq name is defined as 32 bytes, but name would be
silently truncated at 31 bytes. The function strlcpy() size
already accounts for the nul character at the end.


Fixes: f9acaf84e923 ("replace snprintf with strlcpy without adding extra include")
Cc: stable@dpdk.org

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
Exposed by automated review of next patch.

 lib/eal/common/eal_common_tailqs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/eal/common/eal_common_tailqs.c b/lib/eal/common/eal_common_tailqs.c
index c581f43b6f..fe3ced21c7 100644
--- a/lib/eal/common/eal_common_tailqs.c
+++ b/lib/eal/common/eal_common_tailqs.c
@@ -83,7 +83,7 @@ rte_eal_tailq_create(const char *name)
 
 		mcfg = rte_eal_get_configuration()->mem_config;
 		head = &mcfg->tailq_head[rte_tailqs_count];
-		strlcpy(head->name, name, sizeof(head->name) - 1);
+		strlcpy(head->name, name, sizeof(head->name));
 		TAILQ_INIT(&head->tailq_head);
 		rte_tailqs_count++;
 	}
-- 
2.53.0

[PATCH v3 2/2] eal: add destructor to unregister tailq on unload

[Stephen Hemminger]

EAL_REGISTER_TAILQ registers a static rte_tailq_elem from a
constructor but provides no destructor. If a library using the
macro is loaded with dlopen() and later unloaded with dlclose(),
the process-local list keeps a dangling pointer to the unmapped
elem, and the next dlopen() crashes in rte_eal_tailq_local_register()
while walking the list.

Add a new RTE_FINI destructor that is paired with the constructor
in the macro. rte_eal_tailq_unregister() drops the local entry on
unload. The shared mcfg->tailq_head[] slot is left reserved since
it is keyed by name and shared between processes;
rte_eal_tailq_update() now reattaches to that slot on re-register
instead of failing.

Bugzilla ID: 1081
Fixes: 873a61c7526b ("tailq: introduce dynamic register system")
Cc: stable@dpdk.org

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>
---
 lib/eal/common/eal_common_tailqs.c | 13 +++++++++++++
 lib/eal/include/rte_tailq.h        | 16 ++++++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/lib/eal/common/eal_common_tailqs.c b/lib/eal/common/eal_common_tailqs.c
index fe3ced21c7..34e6883f65 100644
--- a/lib/eal/common/eal_common_tailqs.c
+++ b/lib/eal/common/eal_common_tailqs.c
@@ -113,6 +113,11 @@ rte_eal_tailq_update(struct rte_tailq_elem *t)
 	if (rte_eal_process_type() == RTE_PROC_PRIMARY) {
 		/* primary process is the only one that creates */
 		t->head = rte_eal_tailq_create(t->name);
+
+		if (t->head == NULL) {
+			/* slot reserved by an earlier load -- reuse it */
+			t->head = rte_eal_tailq_lookup(t->name);
+		}
 	} else {
 		t->head = rte_eal_tailq_lookup(t->name);
 	}
@@ -148,6 +153,14 @@ rte_eal_tailq_register(struct rte_tailq_elem *t)
 	return -1;
 }
 
+RTE_EXPORT_SYMBOL(rte_eal_tailq_unregister)
+void
+rte_eal_tailq_unregister(struct rte_tailq_elem *t)
+{
+	TAILQ_REMOVE(&rte_tailq_elem_head, t, next);
+	t->head = NULL;
+}
+
 int
 rte_eal_tailqs_init(void)
 {
diff --git a/lib/eal/include/rte_tailq.h b/lib/eal/include/rte_tailq.h
index e7caed6812..d4d8bfd6d4 100644
--- a/lib/eal/include/rte_tailq.h
+++ b/lib/eal/include/rte_tailq.h
@@ -117,11 +117,27 @@ struct rte_tailq_head *rte_eal_tailq_lookup(const char *name);
  */
 int rte_eal_tailq_register(struct rte_tailq_elem *t);
 
+/**
+ * Remove a tail queue element from the local list.
+ * This function is mainly used for EAL_REGISTER_TAILQ macro which pairs
+ * an RTE_FINI destructor with the existing RTE_INIT constructor.
+ * The destructor calls this function during dlclose() to prevent
+ * dangling pointers to unmapped library data.
+ *
+ * @param t
+ *   The tailq element to remove from the EAL tailq list.
+ */
+void rte_eal_tailq_unregister(struct rte_tailq_elem *t);
+
 #define EAL_REGISTER_TAILQ(t) \
 RTE_INIT(tailqinitfn_ ##t) \
 { \
 	if (rte_eal_tailq_register(&t) < 0) \
 		rte_panic("Cannot initialize tailq: %s\n", t.name); \
+} \
+RTE_FINI(tailqfinifn_ ##t) \
+{ \
+	rte_eal_tailq_unregister(&t); \
 }
 
 /* This macro permits both remove and free var within the loop safely.*/
-- 
2.53.0

Re: [PATCH v2] eal: add destructor to unregister tailq on unload

[fengchengwen]

On 6/9/2026 10:26 PM, Stephen Hemminger wrote:
> EAL_REGISTER_TAILQ registers a static rte_tailq_elem from a
> constructor but provides no destructor. If a library using the
> macro is loaded with dlopen() and later unloaded with dlclose(),
> the process-local list keeps a dangling pointer to the unmapped
> elem, and the next dlopen() crashes in rte_eal_tailq_local_register()
> while walking the list.
> 
> Add a new RTE_FINI destructor that is paired with the constructor
> in the macro. rte_eal_tailq_unregister() drops the local entry on
> unload. The shared mcfg->tailq_head[] slot is left reserved since
> it is keyed by name and shared between processes;
> rte_eal_tailq_update() now reattaches to that slot on re-register
> instead of failing.
> 
> Bugzilla ID: 1081
> Fixes: 873a61c7526b ("tailq: introduce dynamic register system")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
> Acked-by: Bruce Richardson <bruce.richardson@intel.com>
> ---
> v2 - cover the case where name still is reserved
> 
>  lib/eal/common/eal_common_tailqs.c | 13 +++++++++++++
>  lib/eal/include/rte_tailq.h        | 16 ++++++++++++++++
>  2 files changed, 29 insertions(+)
> 
> diff --git a/lib/eal/common/eal_common_tailqs.c b/lib/eal/common/eal_common_tailqs.c
> index c581f43b6f..9355c108f2 100644
> --- a/lib/eal/common/eal_common_tailqs.c
> +++ b/lib/eal/common/eal_common_tailqs.c
> @@ -113,6 +113,11 @@ rte_eal_tailq_update(struct rte_tailq_elem *t)
>  	if (rte_eal_process_type() == RTE_PROC_PRIMARY) {
>  		/* primary process is the only one that creates */
>  		t->head = rte_eal_tailq_create(t->name);
> +
> +		if (t->head == NULL) {
> +			/* slot reserved by an earlier load -- reuse it */
> +			t->head = rte_eal_tailq_lookup(t->name);



> +		}
>  	} else {
>  		t->head = rte_eal_tailq_lookup(t->name);
>  	}
> @@ -148,6 +153,14 @@ rte_eal_tailq_register(struct rte_tailq_elem *t)
>  	return -1;
>  }
>  
> +RTE_EXPORT_SYMBOL(rte_eal_tailq_unregister)

this should be with EXPERIMENTAL

> +void
> +rte_eal_tailq_unregister(struct rte_tailq_elem *t)
> +{
> +	TAILQ_REMOVE(&rte_tailq_elem_head, t, next);

We need first make sure it exist the tailq, just like TAILQ_FOREACH rte_eal_tailq_local_register()

> +	t->head = NULL;
> +}
> +
>  int
>  rte_eal_tailqs_init(void)
>  {
> diff --git a/lib/eal/include/rte_tailq.h b/lib/eal/include/rte_tailq.h
> index e7caed6812..d4d8bfd6d4 100644
> --- a/lib/eal/include/rte_tailq.h
> +++ b/lib/eal/include/rte_tailq.h
> @@ -117,11 +117,27 @@ struct rte_tailq_head *rte_eal_tailq_lookup(const char *name);
>   */
>  int rte_eal_tailq_register(struct rte_tailq_elem *t);
>  
> +/**
> + * Remove a tail queue element from the local list.
> + * This function is mainly used for EAL_REGISTER_TAILQ macro which pairs
> + * an RTE_FINI destructor with the existing RTE_INIT constructor.
> + * The destructor calls this function during dlclose() to prevent
> + * dangling pointers to unmapped library data.

Currently this patch only support next dlopen() the same so file. the
global still exist. Suggest add document for the global entry still exist,
just like commit-log:
"The shared mcfg->tailq_head[] slot is left reserved since
 it is keyed by name and shared between processes;"

> + *
> + * @param t
> + *   The tailq element to remove from the EAL tailq list.
> + */
> +void rte_eal_tailq_unregister(struct rte_tailq_elem *t);
> +
>  #define EAL_REGISTER_TAILQ(t) \
>  RTE_INIT(tailqinitfn_ ##t) \
>  { \
>  	if (rte_eal_tailq_register(&t) < 0) \
>  		rte_panic("Cannot initialize tailq: %s\n", t.name); \
> +} \
> +RTE_FINI(tailqfinifn_ ##t) \
> +{ \
> +	rte_eal_tailq_unregister(&t); \
>  }
>  
>  /* This macro permits both remove and free var within the loop safely.*/

Re: [PATCH v3 1/2] eal: fix off by one in in tailq name init

[fengchengwen]

Acked-by: Chengwen Feng <fengchengwen@huawei.com>

On 6/9/2026 11:53 PM, Stephen Hemminger wrote:
> The tailq name is defined as 32 bytes, but name would be
> silently truncated at 31 bytes. The function strlcpy() size
> already accounts for the nul character at the end.

nul -> NUL

> 
> 
> Fixes: f9acaf84e923 ("replace snprintf with strlcpy without adding extra include")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>

Re: [PATCH v2] eal: add destructor to unregister tailq on unload

[Stephen Hemminger]

On Wed, 10 Jun 2026 09:19:42 +0800
fengchengwen <fengchengwen@huawei.com> wrote:

> >  
> > +RTE_EXPORT_SYMBOL(rte_eal_tailq_unregister)  
> 
> this should be with EXPERIMENTAL

Not possible, this is part of the EAL_REGISTER_TAILQ macro and usage
is under the covers. So if anything was marked experimental it would
fail code that did not allow experimental

> 
> > +void
> > +rte_eal_tailq_unregister(struct rte_tailq_elem *t)
> > +{
> > +	TAILQ_REMOVE(&rte_tailq_elem_head, t, next);  
> 
> We need first make sure it exist the tailq, just like TAILQ_FOREACH rte_eal_tailq_local_register()

Ok cheap scan since not in critical path.