[PATCH] net/af_xdp: fix default device plugin path

[PATCH] net/af_xdp: fix default device plugin path

[Anurag Mandal]

When use_cni=1 or use_pinned_map=1 is passed without an explicit
dp_path, the PMD builds the path to the AF_XDP device plugin
endpoint itself.
That default was hardcoded to /tmp/afxdp_dp/<if_name>/.

A unix domain socket and a pinned map are runtime state.
Current Linux file hierarchy conventions place these below
the runtime directory, not below world writable /tmp.
DPDK already exposes such a location through
rte_eal_get_runtime_dir().

The location cannot simply be moved as it is a contract
duplicated in the AF_XDP Device Plugin for Kubernetes,
which creates the socket and mounts it into the pod at
the /tmp path the PMD expects.
Changing only the PMD would break every existing deployment.

This patch fixes the default so that the endpoint is looked
up below the EAL runtime directory first, and fall back to
/tmp/afxdp_dp only when nothing is found there, a warning
is logged whenever that fallback is taken.
Existing plugin deployments keep working unchanged, while
a deployment, that places the endpoint in the runtime
directory, no longer has to pass dp_path.
An explicit dp_path still overrides both.

The <if_name> component is kept in both layouts. It is what
keeps the endpoints of several interfaces distinct when more
than one UDS server is mounted in a single pod.

The runtime directory prefix makes the built path longer,
so reject a dp_path that does not fit the sun_path field
of struct sockaddr_un instead of letting strlcpy()
silently truncate it.

The interface name check is moved ahead of the path
construction, as the default path is now built from it.

Bugzilla ID: 1973
Fixes: 9c1323736cf9 ("net/af_xdp: fix multi-interface support for k8s")
Fixes: 8a324b1c6464 ("net/af_xdp: support AF_XDP device plugin pinned maps")
Cc: stable@dpdk.org

Signed-off-by: Anurag Mandal <anurag.mandal@intel.com>
---
 doc/guides/howto/af_xdp_dp.rst      | 24 ++++++++-
 doc/guides/nics/af_xdp.rst          | 26 ++++++++--
 drivers/net/af_xdp/rte_eth_af_xdp.c | 76 ++++++++++++++++++++++++++---
 3 files changed, 114 insertions(+), 12 deletions(-)

diff --git a/doc/guides/howto/af_xdp_dp.rst b/doc/guides/howto/af_xdp_dp.rst
index c194ead250..e9eeace749 100644
--- a/doc/guides/howto/af_xdp_dp.rst
+++ b/doc/guides/howto/af_xdp_dp.rst
@@ -68,7 +68,25 @@ arguments to explicitly tell the AF_XDP PMD where to find either:
 2. The pinned xskmap to use when creating AF_XDP sockets.
 
 If this argument is not passed alongside the ``use_cni`` or ``use_pinned_map`` arguments
-then the AF_XDP PMD configures it internally to the `AF_XDP Device Plugin for Kubernetes`_.
+then the AF_XDP PMD builds the path itself.
+It looks for ``afxdp_dp/<if_name>/afxdp.sock``
+(or ``afxdp_dp/<if_name>/xsks_map``) below the EAL runtime directory,
+which is where runtime state such as sockets belongs.
+When no such entry exists, the PMD falls back to the same file
+below ``/tmp/afxdp_dp``, the location used by the
+`AF_XDP Device Plugin for Kubernetes`_.
+
+.. note::
+
+   The ``/tmp/afxdp_dp`` fallback exists only for compatibility with
+   deployments of the `AF_XDP Device Plugin for Kubernetes`_
+   that mount the endpoint there.
+   New deployments should place the socket or pinned map
+   below the EAL runtime directory,
+   or point at it explicitly with ``dp_path``.
+   The ``<if_name>`` component of the path must be kept in either location:
+   it is what distinguishes the endpoints
+   when several interfaces are mounted in a single pod.
 
 .. note::
 
@@ -339,4 +357,6 @@ Run dpdk-testpmd with the AF_XDP Device Plugin + CNI
 .. note::
 
    If the ``dp_path`` parameter isn't explicitly set with ``use_cni`` or ``use_pinned_map``
-   the AF_XDP PMD will set the parameter values to the `AF_XDP Device Plugin for Kubernetes`_ defaults.
+   the AF_XDP PMD looks for the endpoint below the EAL runtime directory first,
+   and only then below the ``/tmp/afxdp_dp`` location
+   used by the `AF_XDP Device Plugin for Kubernetes`_.
diff --git a/doc/guides/nics/af_xdp.rst b/doc/guides/nics/af_xdp.rst
index c455b4c066..94583dbb62 100644
--- a/doc/guides/nics/af_xdp.rst
+++ b/doc/guides/nics/af_xdp.rst
@@ -199,18 +199,36 @@ to explicitly tell the AF_XDP PMD where to find either:
 1. The UDS to interact with the AF_XDP Device Plugin. OR
 2. The pinned xskmap to use when creating AF_XDP sockets.
 
-If this argument is not passed alongside the ``use_cni`` or ``use_pinned_map`` arguments then
-the AF_XDP PMD configures it internally to the `AF_XDP Device Plugin for Kubernetes`_.
+If this argument is not passed alongside the ``use_cni`` or ``use_pinned_map`` arguments,
+the AF_XDP PMD builds the path itself.
+It looks for ``afxdp_dp/<<interface name>>/afxdp.sock``
+(or ``afxdp_dp/<<interface name>>/xsks_map``) below the EAL runtime directory,
+which is where runtime state such as sockets belongs.
+When no such entry exists, the PMD falls back to the same file
+below ``/tmp/afxdp_dp``, the location used by the
+`AF_XDP Device Plugin for Kubernetes`_.
 
 .. _AF_XDP Device Plugin for Kubernetes: https://github.com/redhat-et/afxdp-plugins-for-kubernetes
 
+.. note::
+
+   The ``/tmp/afxdp_dp`` fallback exists only for compatibility with
+   deployments of the `AF_XDP Device Plugin for Kubernetes`_
+   that mount the endpoint there.
+   New deployments should place the socket or pinned map
+   below the EAL runtime directory,
+   or point at it explicitly with ``dp_path``.
+   The interface name component of the path must be kept in either location:
+   it is what distinguishes the endpoints
+   when several interfaces are mounted in a single pod.
+
 .. code-block:: console
 
-   --vdev=net_af_xdp0,use_cni=1,dp_path="/tmp/afxdp_dp/<<interface name>>/afxdp.sock"
+   --vdev=net_af_xdp0,use_cni=1,dp_path="/var/run/dpdk/rte/afxdp_dp/<<interface name>>/afxdp.sock"
 
 .. code-block:: console
 
-   --vdev=net_af_xdp0,use_pinned_map=1,dp_path="/tmp/afxdp_dp/<<interface name>>/xsks_map"
+   --vdev=net_af_xdp0,use_pinned_map=1,dp_path="/var/run/dpdk/rte/afxdp_dp/<<interface name>>/xsks_map"
 
 Limitations
 -----------
diff --git a/drivers/net/af_xdp/rte_eth_af_xdp.c b/drivers/net/af_xdp/rte_eth_af_xdp.c
index 2cdb533276..a7b9cc2cdf 100644
--- a/drivers/net/af_xdp/rte_eth_af_xdp.c
+++ b/drivers/net/af_xdp/rte_eth_af_xdp.c
@@ -83,7 +83,9 @@ RTE_LOG_REGISTER_DEFAULT(af_xdp_logtype, NOTICE);
 
 #define ETH_AF_XDP_MP_KEY "afxdp_mp_send_fds"
 
-#define DP_BASE_PATH			"/tmp/afxdp_dp"
+/* Directory holding the per interface device plugin endpoints. */
+#define DP_DIR_NAME			"afxdp_dp"
+#define DP_LEGACY_BASE_PATH		"/tmp/" DP_DIR_NAME
 #define DP_UDS_SOCK             "afxdp.sock"
 #define DP_XSK_MAP				"xsks_map"
 #define MAX_LONG_OPT_SZ			64
@@ -1438,6 +1440,11 @@ init_uds_sock(struct sockaddr_un *server, const char *dp_path)
 {
 	int sock;
 
+	if (strnlen(dp_path, PATH_MAX) >= sizeof(server->sun_path)) {
+		AF_XDP_LOG_LINE(ERR, "Device plugin socket path '%s' is too long", dp_path);
+		return -1;
+	}
+
 	sock = socket(AF_UNIX, SOCK_SEQPACKET, 0);
 	if (sock < 0) {
 		AF_XDP_LOG_LINE(ERR, "Failed to opening stream socket");
@@ -2459,6 +2466,48 @@ afxdp_mp_send_fds(const struct rte_mp_msg *request, const void *peer)
 	return 0;
 }
 
+/*
+ * Build the default device plugin path for an interface.
+ *
+ * Unix domain sockets and pinned maps are runtime state, so the runtime
+ * directory is preferred over the world writable /tmp. The AF_XDP Device
+ * Plugin for Kubernetes still creates and mounts these endpoints below
+ * DP_LEGACY_BASE_PATH, so that location is used when the runtime directory
+ * holds no entry for the interface.
+ *
+ * The interface name is always part of the path: it keeps the endpoints of
+ * several interfaces distinct when more than one is mounted in a single pod.
+ */
+static int
+get_dflt_dp_path(char *dp_path, size_t size, const char *if_name,
+		 const char *entry)
+{
+	int ret;
+
+	ret = snprintf(dp_path, size, "%s/%s/%s/%s", rte_eal_get_runtime_dir(),
+		       DP_DIR_NAME, if_name, entry);
+	if (ret < 0 || (size_t)ret >= size)
+		goto too_long;
+
+	if (access(dp_path, F_OK) == 0)
+		return 0;
+
+	ret = snprintf(dp_path, size, "%s/%s/%s", DP_LEGACY_BASE_PATH, if_name,
+		       entry);
+	if (ret < 0 || (size_t)ret >= size)
+		goto too_long;
+
+	AF_XDP_LOG_LINE(WARNING,
+		"No '%s' entry for %s below '%s', falling back to '%s'",
+		entry, if_name, rte_eal_get_runtime_dir(), DP_LEGACY_BASE_PATH);
+
+	return 0;
+
+too_long:
+	AF_XDP_LOG_LINE(ERR, "Device plugin path for %s is too long", if_name);
+	return -ENAMETOOLONG;
+}
+
 static int
 rte_pmd_af_xdp_probe(struct rte_vdev_device *dev)
 {
@@ -2522,6 +2571,11 @@ rte_pmd_af_xdp_probe(struct rte_vdev_device *dev)
 		return -EINVAL;
 	}
 
+	if (strlen(if_name) == 0) {
+		AF_XDP_LOG_LINE(ERR, "Network interface must be specified");
+		return -EINVAL;
+	}
+
 	if (use_cni && use_pinned_map) {
 		AF_XDP_LOG_LINE(ERR, "When '%s' parameter is used, '%s' parameter is not valid",
 			ETH_AF_XDP_USE_CNI_ARG, ETH_AF_XDP_USE_PINNED_MAP_ARG);
@@ -2543,13 +2597,17 @@ rte_pmd_af_xdp_probe(struct rte_vdev_device *dev)
 	}
 
 	if (use_cni && !strnlen(dp_path, PATH_MAX)) {
-		snprintf(dp_path, sizeof(dp_path), "%s/%s/%s", DP_BASE_PATH, if_name, DP_UDS_SOCK);
+		ret = get_dflt_dp_path(dp_path, sizeof(dp_path), if_name, DP_UDS_SOCK);
+		if (ret < 0)
+			return ret;
 		AF_XDP_LOG_LINE(INFO, "'%s' parameter not provided, setting value to '%s'",
 			ETH_AF_XDP_DP_PATH_ARG, dp_path);
 	}
 
 	if (use_pinned_map && !strnlen(dp_path, PATH_MAX)) {
-		snprintf(dp_path, sizeof(dp_path), "%s/%s/%s", DP_BASE_PATH, if_name, DP_XSK_MAP);
+		ret = get_dflt_dp_path(dp_path, sizeof(dp_path), if_name, DP_XSK_MAP);
+		if (ret < 0)
+			return ret;
 		AF_XDP_LOG_LINE(INFO, "'%s' parameter not provided, setting value to '%s'",
 			ETH_AF_XDP_DP_PATH_ARG, dp_path);
 	}
@@ -2561,9 +2619,15 @@ rte_pmd_af_xdp_probe(struct rte_vdev_device *dev)
 		return -EINVAL;
 	}
 
-	if (strlen(if_name) == 0) {
-		AF_XDP_LOG_LINE(ERR, "Network interface must be specified");
-		return -EINVAL;
+	/*
+	 * The socket address is copied into sun_path which is much shorter than
+	 * PATH_MAX, reject an oversized path instead of silently truncating it.
+	 */
+	if (use_cni && strnlen(dp_path, PATH_MAX) >=
+		       RTE_SIZEOF_FIELD(struct sockaddr_un, sun_path)) {
+		AF_XDP_LOG_LINE(ERR, "'%s' value '%s' is too long for a unix socket address",
+				ETH_AF_XDP_DP_PATH_ARG, dp_path);
+		return -ENAMETOOLONG;
 	}
 
 	/* get numa node id from net sysfs */
-- 
2.34.1

Re: [PATCH] net/af_xdp: fix default device plugin path

[Stephen Hemminger]

On Mon, 10 Aug 2026 10:11:58 +0000
Anurag Mandal <anurag.mandal@intel.com> wrote:

> When use_cni=1 or use_pinned_map=1 is passed without an explicit
> dp_path, the PMD builds the path to the AF_XDP device plugin
> endpoint itself.
> That default was hardcoded to /tmp/afxdp_dp/<if_name>/.
> 
> A unix domain socket and a pinned map are runtime state.
> Current Linux file hierarchy conventions place these below
> the runtime directory, not below world writable /tmp.
> DPDK already exposes such a location through
> rte_eal_get_runtime_dir().
> 
> The location cannot simply be moved as it is a contract
> duplicated in the AF_XDP Device Plugin for Kubernetes,
> which creates the socket and mounts it into the pod at
> the /tmp path the PMD expects.
> Changing only the PMD would break every existing deployment.
> 
> This patch fixes the default so that the endpoint is looked
> up below the EAL runtime directory first, and fall back to
> /tmp/afxdp_dp only when nothing is found there, a warning
> is logged whenever that fallback is taken.
> Existing plugin deployments keep working unchanged, while
> a deployment, that places the endpoint in the runtime
> directory, no longer has to pass dp_path.
> An explicit dp_path still overrides both.
> 
> The <if_name> component is kept in both layouts. It is what
> keeps the endpoints of several interfaces distinct when more
> than one UDS server is mounted in a single pod.
> 
> The runtime directory prefix makes the built path longer,
> so reject a dp_path that does not fit the sun_path field
> of struct sockaddr_un instead of letting strlcpy()
> silently truncate it.
> 
> The interface name check is moved ahead of the path
> construction, as the default path is now built from it.
> 
> Bugzilla ID: 1973
> Fixes: 9c1323736cf9 ("net/af_xdp: fix multi-interface support for k8s")
> Fixes: 8a324b1c6464 ("net/af_xdp: support AF_XDP device plugin pinned maps")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Anurag Mandal <anurag.mandal@intel.com>
> ---

Don't think changing path should go to stable.

AI review had overly wordy response. But does make good points
that need to be looked at.

Applies cleanly to main (drivers/net/af_xdp/rte_eth_af_xdp.c,
doc/guides/nics/af_xdp.rst, doc/guides/howto/af_xdp_dp.rst).

No correctness bugs found in the C changes. RTE_SIZEOF_FIELD, unistd.h,
sys/un.h and rte_eal.h are all already available in the file; kvlist is
freed unconditionally inside parse_parameters(), so the two new early
returns in probe() do not leak it; snprintf truncation is checked on both
branches; the moved if_name check lands immediately after
parse_parameters(), which is correct.

The findings below are documentation and process.

Warning: doc/guides/howto/af_xdp_dp.rst - stale note contradicts the patch

  The patch rewrites the paragraph at line 70 but leaves the third note
  block untouched. Post-patch the file reads:

     "It looks for afxdp_dp/<if_name>/afxdp.sock ... below the EAL runtime
      directory ... When no such entry exists, the PMD falls back to ..."

  and then, twenty lines later:

     "In these versions of the PMD if a user doesn't explicitly set the
      dp_path parameter when using use_cni then that path is transparently
      configured in the AF_XDP PMD to the default AF_XDP Device Plugin for
      Kubernetes mount point path."

  The second statement is now wrong. Either fold it into the new text or
  reword it to say the legacy mount point is the fallback.

Warning: doc/guides/nics/af_xdp.rst - line exceeds 100 characters

  The new use_pinned_map example is 103 characters:

    --vdev=net_af_xdp0,use_pinned_map=1,dp_path="/var/run/dpdk/rte/afxdp_dp/<<interface name>>/xsks_map"

  The line it replaces was 88. checkpatches.sh will flag this. The use_cni
  example is 98 and is fine.

Warning: doc/guides/nics/af_xdp.rst - /var/run/dpdk/rte is not the runtime
directory in general

  Both examples now hardcode /var/run/dpdk/rte. eal_create_runtime_dir()
  builds <base>/dpdk/<file-prefix>, where <base> is RUNTIME_DIRECTORY if
  set, /var/run for uid 0, and otherwise XDG_RUNTIME_DIR or /tmp. So for a
  non-root run the path is /tmp/dpdk/rte, and any --file-prefix changes the
  last component. A user copying the example verbatim gets a path that does
  not exist, and the "not below world writable /tmp" rationale in the commit
  message does not hold for the non-root case either.

  Suggest keeping <<interface name>> placeholder style for the prefix too,
  e.g. dp_path="<runtime dir>/afxdp_dp/<<interface name>>/afxdp.sock", with
  one sentence saying the runtime directory is what
  rte_eal_get_runtime_dir() returns and depends on uid and --file-prefix.
  That also brings the pinned-map line back under 100 characters.

Warning: doc - "place the pinned map below the EAL runtime directory" is not
actionable as written

  Both new notes say:

     "New deployments should place the socket or pinned map below the EAL
      runtime directory"

  A pinned eBPF map can only be created by bpf_obj_pin() onto a bpffs mount.
  The EAL runtime directory is an ordinary directory created with mkdir(),
  so nothing can be pinned into it directly - it only works if the deployment
  bind-mounts a bpffs entry there, which is what the device plugin does today
  for /tmp/afxdp_dp. Worth saying "mount the endpoint below" rather than
  "place ... below", so readers do not conclude bpf_obj_pin() will work
  against the runtime directory.

Warning: Cc: stable@dpdk.org on a behavior change

  The patch mixes two things. The strlcpy() truncation fix in init_uds_sock()
  and probe(), plus the moved if_name check, are straightforward fixes and
  are good stable material. Preferring the runtime directory over
  /tmp/afxdp_dp is a new default-resolution policy: it introduces a new
  lookup, a new WARNING on every probe of an existing deployment, and a new
  hard -ENAMETOOLONG failure for dp_path values that previously worked
  (truncated). Stable branches are not supposed to take behavior changes.

  Suggest splitting: patch 1 = truncation rejection + if_name reorder, with
  the two Fixes: tags and Cc: stable; patch 2 = runtime directory preference,
  main only, with a release note entry since it changes the documented
  meaning of an existing vdev argument.

Info: get_dflt_dp_path() could apply the sun_path limit so the fallback is
still reachable

  The helper bounds both snprintf() results against PATH_MAX. For the UDS
  case the real limit is sizeof(sun_path) (108), and that limit is only
  applied later in probe(). runtime_dir itself is bounded by UNIX_PATH_MAX,
  so with a long --file-prefix the runtime-directory candidate can exceed
  107 bytes. If that path happens to exist, probe() now fails with
  -ENAMETOOLONG rather than falling back to the legacy path, which would
  have fit. Passing the applicable limit into the helper (or checking
  sun_path on the first candidate before access()) would keep the fallback
  reachable in that case.

Info: the length check in init_uds_sock() is unreachable

  internals->dp_path is only ever populated from the probe()-validated
  dp_path, and probe() already rejects anything >= sizeof(sun_path) when
  use_cni is set. The check inside init_uds_sock() cannot fire. It is
  harmless defense in depth, but if you want only one, init_uds_sock() is
  the better place - it is the actual point of use and covers send_msg(),
  which does the same strlcpy() into dst.sun_path.

Info: WARNING is a strong level for the currently supported configuration

  get_dflt_dp_path() logs at WARNING every time the runtime directory has no
  entry, which is every probe of every existing AF_XDP Device Plugin
  deployment - i.e. the configuration the documentation still describes as
  supported. NOTICE would convey "you may want to migrate" without making
  correctly configured pods look broken in logs.

[PATCH v2] net/af_xdp: fix default device plugin path

[Anurag Mandal]

When use_cni=1 or use_pinned_map=1 is passed without an explicit
dp_path, the PMD builds the path to the AF_XDP device plugin
endpoint itself.
That default was hardcoded to /tmp/afxdp_dp/<if_name>/.

A unix domain socket and a pinned map are runtime state.
DPDK exposes a location for such state through
rte_eal_get_runtime_dir(), which is per user, per
file prefix, and created with mode 0700, unlike
the shared /tmp/afxdp_dp directory.

The location cannot simply be moved as it is a contract
duplicated in the AF_XDP Device Plugin for Kubernetes,
which creates the socket and mounts it into the pod at
the /tmp path the PMD expects.
Changing only the PMD would break every existing deployment.

This patch fixes the default so that the endpoint is looked
up below the EAL runtime directory first, and /tmp/afxdp_dp
is only used when nothing is found there.
Use of the fallback is logged at notice level.
Existing plugin deployments keep working unchanged, while
a deployment that places the endpoint in the runtime
directory no longer has to pass dp_path.
An explicit dp_path still overrides both.

The <if_name> component is kept in both layouts. It is what
keeps the endpoints of several interfaces distinct when more
than one UDS server is mounted in a single pod.

The runtime directory prefix makes the built path longer,
so reject a dp_path that does not fit the sun_path field
of struct sockaddr_un instead of letting strlcpy()
silently truncate it.

The interface name check is moved ahead of the path
construction, as the default path is now built from it.

Bugzilla ID: 1973
Fixes: 9c1323736cf9 ("net/af_xdp: fix multi-interface support for k8s")
Fixes: 8a324b1c6464 ("net/af_xdp: support AF_XDP device plugin pinned maps")

Signed-off-by: Anurag Mandal <anurag.mandal@intel.com>
---
V2: Addressed Stephen Hemminger's AI review comments

 doc/guides/howto/af_xdp_dp.rst      | 32 +++++++++++--
 doc/guides/nics/af_xdp.rst          | 35 ++++++++++++--
 drivers/net/af_xdp/rte_eth_af_xdp.c | 73 ++++++++++++++++++++++++++---
 3 files changed, 126 insertions(+), 14 deletions(-)

diff --git a/doc/guides/howto/af_xdp_dp.rst b/doc/guides/howto/af_xdp_dp.rst
index c194ead250..7227f29a73 100644
--- a/doc/guides/howto/af_xdp_dp.rst
+++ b/doc/guides/howto/af_xdp_dp.rst
@@ -68,7 +68,28 @@ arguments to explicitly tell the AF_XDP PMD where to find either:
 2. The pinned xskmap to use when creating AF_XDP sockets.
 
 If this argument is not passed alongside the ``use_cni`` or ``use_pinned_map`` arguments
-then the AF_XDP PMD configures it internally to the `AF_XDP Device Plugin for Kubernetes`_.
+then the AF_XDP PMD builds the path itself.
+It looks for ``afxdp_dp/<if_name>/afxdp.sock``
+(or ``afxdp_dp/<if_name>/xsks_map``) in the EAL runtime directory,
+the conventional location for runtime state such as sockets.
+When no such entry exists, the PMD falls back to the same file
+below ``/tmp/afxdp_dp``, the location used by the
+`AF_XDP Device Plugin for Kubernetes`_.
+
+.. note::
+
+   The ``/tmp/afxdp_dp`` fallback exists only for compatibility with
+   deployments of the `AF_XDP Device Plugin for Kubernetes`_
+   that mount the endpoint there.
+   New deployments should mount the endpoint
+   below the EAL runtime directory,
+   or point at it explicitly with ``dp_path``.
+   A pinned map lives on a bpffs mount,
+   so it has to be bind mounted into that directory;
+   it cannot be pinned into the runtime directory itself.
+   The ``<if_name>`` component of the path must be kept in either location:
+   it is what distinguishes the endpoints
+   when several interfaces are mounted in a single pod.
 
 .. note::
 
@@ -80,8 +101,9 @@ then the AF_XDP PMD configures it internally to the `AF_XDP Device Plugin for Ku
    DPDK AF_XDP PMD > v23.11 will work with latest version of the AF_XDP Device Plugin
    through a combination of the ``dp_path`` and/or the ``use_cni`` parameter.
    In these versions of the PMD if a user doesn't explicitly set the ``dp_path`` parameter
-   when using ``use_cni`` then that path is transparently configured in the AF_XDP PMD
-   to the default `AF_XDP Device Plugin for Kubernetes`_ mount point path.
+   when using ``use_cni`` then the PMD looks for the endpoint
+   below the EAL runtime directory first,
+   and falls back to the default `AF_XDP Device Plugin for Kubernetes`_ mount point path.
    The path can be overridden by explicitly setting the ``dp_path`` param.
 
 .. note::
@@ -339,4 +361,6 @@ Run dpdk-testpmd with the AF_XDP Device Plugin + CNI
 .. note::
 
    If the ``dp_path`` parameter isn't explicitly set with ``use_cni`` or ``use_pinned_map``
-   the AF_XDP PMD will set the parameter values to the `AF_XDP Device Plugin for Kubernetes`_ defaults.
+   the AF_XDP PMD looks for the endpoint below the EAL runtime directory first,
+   and only then below the ``/tmp/afxdp_dp`` location
+   used by the `AF_XDP Device Plugin for Kubernetes`_.
diff --git a/doc/guides/nics/af_xdp.rst b/doc/guides/nics/af_xdp.rst
index c455b4c066..4d2ee48ff7 100644
--- a/doc/guides/nics/af_xdp.rst
+++ b/doc/guides/nics/af_xdp.rst
@@ -199,18 +199,45 @@ to explicitly tell the AF_XDP PMD where to find either:
 1. The UDS to interact with the AF_XDP Device Plugin. OR
 2. The pinned xskmap to use when creating AF_XDP sockets.
 
-If this argument is not passed alongside the ``use_cni`` or ``use_pinned_map`` arguments then
-the AF_XDP PMD configures it internally to the `AF_XDP Device Plugin for Kubernetes`_.
+If this argument is not passed alongside the ``use_cni`` or ``use_pinned_map`` arguments,
+the AF_XDP PMD builds the path itself.
+It looks for ``afxdp_dp/<<interface name>>/afxdp.sock``
+(or ``afxdp_dp/<<interface name>>/xsks_map``) in the EAL runtime directory,
+the conventional location for runtime state such as sockets.
+When no such entry exists, the PMD falls back to the same file
+below ``/tmp/afxdp_dp``, the location used by the
+`AF_XDP Device Plugin for Kubernetes`_.
+
+``<runtime_dir>`` below is the EAL runtime directory
+returned by ``rte_eal_get_runtime_dir()``.
+It is not a fixed path:
+it depends on the user ID the application runs as
+and on the ``--file-prefix`` EAL option.
 
 .. _AF_XDP Device Plugin for Kubernetes: https://github.com/redhat-et/afxdp-plugins-for-kubernetes
 
+.. note::
+
+   The ``/tmp/afxdp_dp`` fallback exists only for compatibility with
+   deployments of the `AF_XDP Device Plugin for Kubernetes`_
+   that mount the endpoint there.
+   New deployments should mount the endpoint
+   below the EAL runtime directory,
+   or point at it explicitly with ``dp_path``.
+   A pinned map lives on a bpffs mount,
+   so it has to be bind mounted into that directory;
+   it cannot be pinned into the runtime directory itself.
+   The interface name component of the path must be kept in either location:
+   it is what distinguishes the endpoints
+   when several interfaces are mounted in a single pod.
+
 .. code-block:: console
 
-   --vdev=net_af_xdp0,use_cni=1,dp_path="/tmp/afxdp_dp/<<interface name>>/afxdp.sock"
+   --vdev=net_af_xdp0,use_cni=1,dp_path="<runtime_dir>/afxdp_dp/<<interface name>>/afxdp.sock"
 
 .. code-block:: console
 
-   --vdev=net_af_xdp0,use_pinned_map=1,dp_path="/tmp/afxdp_dp/<<interface name>>/xsks_map"
+   --vdev=net_af_xdp0,use_pinned_map=1,dp_path="<runtime_dir>/afxdp_dp/<<interface name>>/xsks_map"
 
 Limitations
 -----------
diff --git a/drivers/net/af_xdp/rte_eth_af_xdp.c b/drivers/net/af_xdp/rte_eth_af_xdp.c
index 2cdb533276..54bd095c92 100644
--- a/drivers/net/af_xdp/rte_eth_af_xdp.c
+++ b/drivers/net/af_xdp/rte_eth_af_xdp.c
@@ -83,7 +83,9 @@ RTE_LOG_REGISTER_DEFAULT(af_xdp_logtype, NOTICE);
 
 #define ETH_AF_XDP_MP_KEY "afxdp_mp_send_fds"
 
-#define DP_BASE_PATH			"/tmp/afxdp_dp"
+/* Directory holding the per interface device plugin endpoints. */
+#define DP_DIR_NAME			"afxdp_dp"
+#define DP_LEGACY_BASE_PATH		"/tmp/" DP_DIR_NAME
 #define DP_UDS_SOCK             "afxdp.sock"
 #define DP_XSK_MAP				"xsks_map"
 #define MAX_LONG_OPT_SZ			64
@@ -2459,6 +2461,47 @@ afxdp_mp_send_fds(const struct rte_mp_msg *request, const void *peer)
 	return 0;
 }
 
+/*
+ * Build the default device plugin path for an interface.
+ *
+ * Unix domain sockets and pinned maps are runtime state, so the EAL runtime
+ * directory is preferred: it is per user and per file prefix, and both of its
+ * levels are created with mode 0700. The AF_XDP Device Plugin for Kubernetes
+ * still creates and mounts these endpoints below DP_LEGACY_BASE_PATH, so that
+ * location is used when the runtime directory holds no usable entry.
+ *
+ * The interface name is always part of the path: it keeps the endpoints of
+ * several interfaces distinct when more than one is mounted in a single pod.
+ *
+ * "size" is the longest path the caller can use, which may be shorter than the
+ * destination buffer. A runtime directory candidate that does not fit is
+ * skipped rather than rejected, so the shorter legacy path stays reachable.
+ */
+static int
+get_dflt_dp_path(char *dp_path, size_t size, const char *if_name,
+		 const char *entry)
+{
+	int ret;
+
+	ret = snprintf(dp_path, size, "%s/%s/%s/%s", rte_eal_get_runtime_dir(),
+		       DP_DIR_NAME, if_name, entry);
+	if (ret >= 0 && (size_t)ret < size && access(dp_path, F_OK) == 0)
+		return 0;
+
+	ret = snprintf(dp_path, size, "%s/%s/%s", DP_LEGACY_BASE_PATH, if_name,
+		       entry);
+	if (ret < 0 || (size_t)ret >= size) {
+		AF_XDP_LOG_LINE(ERR, "Device plugin path for %s is too long", if_name);
+		return -ENAMETOOLONG;
+	}
+
+	AF_XDP_LOG_LINE(NOTICE,
+		"No usable '%s' entry for %s below '%s', falling back to '%s'",
+		entry, if_name, rte_eal_get_runtime_dir(), DP_LEGACY_BASE_PATH);
+
+	return 0;
+}
+
 static int
 rte_pmd_af_xdp_probe(struct rte_vdev_device *dev)
 {
@@ -2522,6 +2565,11 @@ rte_pmd_af_xdp_probe(struct rte_vdev_device *dev)
 		return -EINVAL;
 	}
 
+	if (strlen(if_name) == 0) {
+		AF_XDP_LOG_LINE(ERR, "Network interface must be specified");
+		return -EINVAL;
+	}
+
 	if (use_cni && use_pinned_map) {
 		AF_XDP_LOG_LINE(ERR, "When '%s' parameter is used, '%s' parameter is not valid",
 			ETH_AF_XDP_USE_CNI_ARG, ETH_AF_XDP_USE_PINNED_MAP_ARG);
@@ -2543,13 +2591,20 @@ rte_pmd_af_xdp_probe(struct rte_vdev_device *dev)
 	}
 
 	if (use_cni && !strnlen(dp_path, PATH_MAX)) {
-		snprintf(dp_path, sizeof(dp_path), "%s/%s/%s", DP_BASE_PATH, if_name, DP_UDS_SOCK);
+		/* The UDS path is bounded by sun_path, not by PATH_MAX. */
+		ret = get_dflt_dp_path(dp_path,
+				RTE_SIZEOF_FIELD(struct sockaddr_un, sun_path),
+				if_name, DP_UDS_SOCK);
+		if (ret < 0)
+			return ret;
 		AF_XDP_LOG_LINE(INFO, "'%s' parameter not provided, setting value to '%s'",
 			ETH_AF_XDP_DP_PATH_ARG, dp_path);
 	}
 
 	if (use_pinned_map && !strnlen(dp_path, PATH_MAX)) {
-		snprintf(dp_path, sizeof(dp_path), "%s/%s/%s", DP_BASE_PATH, if_name, DP_XSK_MAP);
+		ret = get_dflt_dp_path(dp_path, sizeof(dp_path), if_name, DP_XSK_MAP);
+		if (ret < 0)
+			return ret;
 		AF_XDP_LOG_LINE(INFO, "'%s' parameter not provided, setting value to '%s'",
 			ETH_AF_XDP_DP_PATH_ARG, dp_path);
 	}
@@ -2561,9 +2616,15 @@ rte_pmd_af_xdp_probe(struct rte_vdev_device *dev)
 		return -EINVAL;
 	}
 
-	if (strlen(if_name) == 0) {
-		AF_XDP_LOG_LINE(ERR, "Network interface must be specified");
-		return -EINVAL;
+	/*
+	 * The socket address is copied into sun_path which is much shorter than
+	 * PATH_MAX, reject an oversized path instead of silently truncating it.
+	 */
+	if (use_cni && strnlen(dp_path, PATH_MAX) >=
+		       RTE_SIZEOF_FIELD(struct sockaddr_un, sun_path)) {
+		AF_XDP_LOG_LINE(ERR, "'%s' value '%s' is too long for a unix socket address",
+				ETH_AF_XDP_DP_PATH_ARG, dp_path);
+		return -ENAMETOOLONG;
 	}
 
 	/* get numa node id from net sysfs */
-- 
2.34.1

Re: [PATCH v2] net/af_xdp: fix default device plugin path

[Stephen Hemminger]

On Tue, 11 Aug 2026 08:27:57 +0000
Anurag Mandal <anurag.mandal@intel.com> wrote:

> dp_path, the PMD builds the path to the AF_XDP device plugin
> endpoint itself.
> That default was hardcoded to /tmp/afxdp_dp/<if_name>/.
> 
> A unix domain socket and a pinned map are runtime state.
> DPDK exposes a location for such state through
> rte_eal_get_runtime_dir(), which is per user, per
> file prefix, and created with mode 0700, unlike
> the shared /tmp/afxdp_dp directory.
> 
> The location cannot simply be moved as it is a contract
> duplicated in the AF_XDP Device Plugin for Kubernetes,
> which creates the socket and mounts it into the pod at
> the /tmp path the PMD expects.
> Changing only the PMD would break every existing deployment.
> 
> This patch fixes the default so that the endpoint is looked
> up below the EAL runtime directory first, and /tmp/afxdp_dp
> is only used when nothing is found there.
> Use of the fallback is logged at notice level.
> Existing plugin deployments keep working unchanged, while
> a deployment that places the endpoint in the runtime
> directory no longer has to pass dp_path.
> An explicit dp_path still overrides both.
> 
> The <if_name> component is kept in both layouts. It is what
> keeps the endpoints of several interfaces distinct when more
> than one UDS server is mounted in a single pod.
> 
> The runtime directory prefix makes the built path longer,
> so reject a dp_path that does not fit the sun_path field
> of struct sockaddr_un instead of letting strlcpy()
> silently truncate it.
> 
> The interface name check is moved ahead of the path
> construction, as the default path is now built from it.
> 
> Bugzilla ID: 1973
> Fixes: 9c1323736cf9 ("net/af_xdp: fix multi-interface support for k8s")
> Fixes: 8a324b1c6464 ("net/af_xdp: support AF_XDP device plugin pinned maps")
> 
> Signed-off-by: Anurag Mandal <anurag.mandal@intel.com>
> ---

Looks good but needs a release note.

[PATCH v3] net/af_xdp: fix default device plugin path

[Anurag Mandal]

When use_cni=1 or use_pinned_map=1 is passed without an explicit
dp_path, the PMD builds the path to the AF_XDP device plugin
endpoint itself.
That default was hardcoded to /tmp/afxdp_dp/<if_name>/.

A unix domain socket and a pinned map are runtime state.
DPDK exposes a location for such state through
rte_eal_get_runtime_dir(), which is per user, per
file prefix, and created with mode 0700, unlike
the shared /tmp/afxdp_dp directory.

The location cannot simply be moved as it is a contract
duplicated in the AF_XDP Device Plugin for Kubernetes,
which creates the socket and mounts it into the pod at
the /tmp path the PMD expects.
Changing only the PMD would break every existing deployment.

This patch fixes the default so that the endpoint is looked
up below the EAL runtime directory first, and /tmp/afxdp_dp
is only used when nothing is found there.
Use of the fallback is logged at notice level.
Existing plugin deployments keep working unchanged, while
a deployment that places the endpoint in the runtime
directory no longer has to pass dp_path.
An explicit dp_path still overrides both.

The <if_name> component is kept in both layouts. It is what
keeps the endpoints of several interfaces distinct when more
than one UDS server is mounted in a single pod.

The runtime directory prefix makes the built path longer,
so reject a dp_path that does not fit the sun_path field
of struct sockaddr_un instead of letting strlcpy()
silently truncate it.

The interface name check is moved ahead of the path
construction, as the default path is now built from it.

Bugzilla ID: 1973
Fixes: 9c1323736cf9 ("net/af_xdp: fix multi-interface support for k8s")
Fixes: 8a324b1c6464 ("net/af_xdp: support AF_XDP device plugin pinned maps")

Signed-off-by: Anurag Mandal <anurag.mandal@intel.com>
---
V3: Added release note
V2: Addressed Stephen Hemminger's AI review comments

 doc/guides/howto/af_xdp_dp.rst         | 32 +++++++++--
 doc/guides/nics/af_xdp.rst             | 35 ++++++++++--
 doc/guides/rel_notes/release_26_11.rst | 13 +++++
 drivers/net/af_xdp/rte_eth_af_xdp.c    | 73 +++++++++++++++++++++++---
 4 files changed, 139 insertions(+), 14 deletions(-)

diff --git a/doc/guides/howto/af_xdp_dp.rst b/doc/guides/howto/af_xdp_dp.rst
index c194ead250..7227f29a73 100644
--- a/doc/guides/howto/af_xdp_dp.rst
+++ b/doc/guides/howto/af_xdp_dp.rst
@@ -68,7 +68,28 @@ arguments to explicitly tell the AF_XDP PMD where to find either:
 2. The pinned xskmap to use when creating AF_XDP sockets.
 
 If this argument is not passed alongside the ``use_cni`` or ``use_pinned_map`` arguments
-then the AF_XDP PMD configures it internally to the `AF_XDP Device Plugin for Kubernetes`_.
+then the AF_XDP PMD builds the path itself.
+It looks for ``afxdp_dp/<if_name>/afxdp.sock``
+(or ``afxdp_dp/<if_name>/xsks_map``) in the EAL runtime directory,
+the conventional location for runtime state such as sockets.
+When no such entry exists, the PMD falls back to the same file
+below ``/tmp/afxdp_dp``, the location used by the
+`AF_XDP Device Plugin for Kubernetes`_.
+
+.. note::
+
+   The ``/tmp/afxdp_dp`` fallback exists only for compatibility with
+   deployments of the `AF_XDP Device Plugin for Kubernetes`_
+   that mount the endpoint there.
+   New deployments should mount the endpoint
+   below the EAL runtime directory,
+   or point at it explicitly with ``dp_path``.
+   A pinned map lives on a bpffs mount,
+   so it has to be bind mounted into that directory;
+   it cannot be pinned into the runtime directory itself.
+   The ``<if_name>`` component of the path must be kept in either location:
+   it is what distinguishes the endpoints
+   when several interfaces are mounted in a single pod.
 
 .. note::
 
@@ -80,8 +101,9 @@ then the AF_XDP PMD configures it internally to the `AF_XDP Device Plugin for Ku
    DPDK AF_XDP PMD > v23.11 will work with latest version of the AF_XDP Device Plugin
    through a combination of the ``dp_path`` and/or the ``use_cni`` parameter.
    In these versions of the PMD if a user doesn't explicitly set the ``dp_path`` parameter
-   when using ``use_cni`` then that path is transparently configured in the AF_XDP PMD
-   to the default `AF_XDP Device Plugin for Kubernetes`_ mount point path.
+   when using ``use_cni`` then the PMD looks for the endpoint
+   below the EAL runtime directory first,
+   and falls back to the default `AF_XDP Device Plugin for Kubernetes`_ mount point path.
    The path can be overridden by explicitly setting the ``dp_path`` param.
 
 .. note::
@@ -339,4 +361,6 @@ Run dpdk-testpmd with the AF_XDP Device Plugin + CNI
 .. note::
 
    If the ``dp_path`` parameter isn't explicitly set with ``use_cni`` or ``use_pinned_map``
-   the AF_XDP PMD will set the parameter values to the `AF_XDP Device Plugin for Kubernetes`_ defaults.
+   the AF_XDP PMD looks for the endpoint below the EAL runtime directory first,
+   and only then below the ``/tmp/afxdp_dp`` location
+   used by the `AF_XDP Device Plugin for Kubernetes`_.
diff --git a/doc/guides/nics/af_xdp.rst b/doc/guides/nics/af_xdp.rst
index c455b4c066..4d2ee48ff7 100644
--- a/doc/guides/nics/af_xdp.rst
+++ b/doc/guides/nics/af_xdp.rst
@@ -199,18 +199,45 @@ to explicitly tell the AF_XDP PMD where to find either:
 1. The UDS to interact with the AF_XDP Device Plugin. OR
 2. The pinned xskmap to use when creating AF_XDP sockets.
 
-If this argument is not passed alongside the ``use_cni`` or ``use_pinned_map`` arguments then
-the AF_XDP PMD configures it internally to the `AF_XDP Device Plugin for Kubernetes`_.
+If this argument is not passed alongside the ``use_cni`` or ``use_pinned_map`` arguments,
+the AF_XDP PMD builds the path itself.
+It looks for ``afxdp_dp/<<interface name>>/afxdp.sock``
+(or ``afxdp_dp/<<interface name>>/xsks_map``) in the EAL runtime directory,
+the conventional location for runtime state such as sockets.
+When no such entry exists, the PMD falls back to the same file
+below ``/tmp/afxdp_dp``, the location used by the
+`AF_XDP Device Plugin for Kubernetes`_.
+
+``<runtime_dir>`` below is the EAL runtime directory
+returned by ``rte_eal_get_runtime_dir()``.
+It is not a fixed path:
+it depends on the user ID the application runs as
+and on the ``--file-prefix`` EAL option.
 
 .. _AF_XDP Device Plugin for Kubernetes: https://github.com/redhat-et/afxdp-plugins-for-kubernetes
 
+.. note::
+
+   The ``/tmp/afxdp_dp`` fallback exists only for compatibility with
+   deployments of the `AF_XDP Device Plugin for Kubernetes`_
+   that mount the endpoint there.
+   New deployments should mount the endpoint
+   below the EAL runtime directory,
+   or point at it explicitly with ``dp_path``.
+   A pinned map lives on a bpffs mount,
+   so it has to be bind mounted into that directory;
+   it cannot be pinned into the runtime directory itself.
+   The interface name component of the path must be kept in either location:
+   it is what distinguishes the endpoints
+   when several interfaces are mounted in a single pod.
+
 .. code-block:: console
 
-   --vdev=net_af_xdp0,use_cni=1,dp_path="/tmp/afxdp_dp/<<interface name>>/afxdp.sock"
+   --vdev=net_af_xdp0,use_cni=1,dp_path="<runtime_dir>/afxdp_dp/<<interface name>>/afxdp.sock"
 
 .. code-block:: console
 
-   --vdev=net_af_xdp0,use_pinned_map=1,dp_path="/tmp/afxdp_dp/<<interface name>>/xsks_map"
+   --vdev=net_af_xdp0,use_pinned_map=1,dp_path="<runtime_dir>/afxdp_dp/<<interface name>>/xsks_map"
 
 Limitations
 -----------
diff --git a/doc/guides/rel_notes/release_26_11.rst b/doc/guides/rel_notes/release_26_11.rst
index c8cc86295d..97a6a0e0bb 100644
--- a/doc/guides/rel_notes/release_26_11.rst
+++ b/doc/guides/rel_notes/release_26_11.rst
@@ -55,6 +55,19 @@ New Features
      Also, make sure to start the actual text at the margin.
      =======================================================
 
+* **Updated AF_XDP driver.**
+
+  * Changed the default AF_XDP Device Plugin endpoint location.
+
+    When set without ``dp_path``, the PMD first looks for
+    ``afxdp_dp/<if_name>/`` in the EAL runtime directory,
+    and would fall back to ``/tmp/afxdp_dp/<if_name>/`` only when
+    nothing is found there.
+    Existing AF_XDP Device Plugin deployments keep working unchanged.
+
+  * A ``dp_path`` value that does not fit the ``sun_path`` field
+    of ``struct sockaddr_un`` is now rejected with ``ENAMETOOLONG``
+    instead of being silently truncated.
 
 Removed Items
 -------------
diff --git a/drivers/net/af_xdp/rte_eth_af_xdp.c b/drivers/net/af_xdp/rte_eth_af_xdp.c
index 2cdb533276..54bd095c92 100644
--- a/drivers/net/af_xdp/rte_eth_af_xdp.c
+++ b/drivers/net/af_xdp/rte_eth_af_xdp.c
@@ -83,7 +83,9 @@ RTE_LOG_REGISTER_DEFAULT(af_xdp_logtype, NOTICE);
 
 #define ETH_AF_XDP_MP_KEY "afxdp_mp_send_fds"
 
-#define DP_BASE_PATH			"/tmp/afxdp_dp"
+/* Directory holding the per interface device plugin endpoints. */
+#define DP_DIR_NAME			"afxdp_dp"
+#define DP_LEGACY_BASE_PATH		"/tmp/" DP_DIR_NAME
 #define DP_UDS_SOCK             "afxdp.sock"
 #define DP_XSK_MAP				"xsks_map"
 #define MAX_LONG_OPT_SZ			64
@@ -2459,6 +2461,47 @@ afxdp_mp_send_fds(const struct rte_mp_msg *request, const void *peer)
 	return 0;
 }
 
+/*
+ * Build the default device plugin path for an interface.
+ *
+ * Unix domain sockets and pinned maps are runtime state, so the EAL runtime
+ * directory is preferred: it is per user and per file prefix, and both of its
+ * levels are created with mode 0700. The AF_XDP Device Plugin for Kubernetes
+ * still creates and mounts these endpoints below DP_LEGACY_BASE_PATH, so that
+ * location is used when the runtime directory holds no usable entry.
+ *
+ * The interface name is always part of the path: it keeps the endpoints of
+ * several interfaces distinct when more than one is mounted in a single pod.
+ *
+ * "size" is the longest path the caller can use, which may be shorter than the
+ * destination buffer. A runtime directory candidate that does not fit is
+ * skipped rather than rejected, so the shorter legacy path stays reachable.
+ */
+static int
+get_dflt_dp_path(char *dp_path, size_t size, const char *if_name,
+		 const char *entry)
+{
+	int ret;
+
+	ret = snprintf(dp_path, size, "%s/%s/%s/%s", rte_eal_get_runtime_dir(),
+		       DP_DIR_NAME, if_name, entry);
+	if (ret >= 0 && (size_t)ret < size && access(dp_path, F_OK) == 0)
+		return 0;
+
+	ret = snprintf(dp_path, size, "%s/%s/%s", DP_LEGACY_BASE_PATH, if_name,
+		       entry);
+	if (ret < 0 || (size_t)ret >= size) {
+		AF_XDP_LOG_LINE(ERR, "Device plugin path for %s is too long", if_name);
+		return -ENAMETOOLONG;
+	}
+
+	AF_XDP_LOG_LINE(NOTICE,
+		"No usable '%s' entry for %s below '%s', falling back to '%s'",
+		entry, if_name, rte_eal_get_runtime_dir(), DP_LEGACY_BASE_PATH);
+
+	return 0;
+}
+
 static int
 rte_pmd_af_xdp_probe(struct rte_vdev_device *dev)
 {
@@ -2522,6 +2565,11 @@ rte_pmd_af_xdp_probe(struct rte_vdev_device *dev)
 		return -EINVAL;
 	}
 
+	if (strlen(if_name) == 0) {
+		AF_XDP_LOG_LINE(ERR, "Network interface must be specified");
+		return -EINVAL;
+	}
+
 	if (use_cni && use_pinned_map) {
 		AF_XDP_LOG_LINE(ERR, "When '%s' parameter is used, '%s' parameter is not valid",
 			ETH_AF_XDP_USE_CNI_ARG, ETH_AF_XDP_USE_PINNED_MAP_ARG);
@@ -2543,13 +2591,20 @@ rte_pmd_af_xdp_probe(struct rte_vdev_device *dev)
 	}
 
 	if (use_cni && !strnlen(dp_path, PATH_MAX)) {
-		snprintf(dp_path, sizeof(dp_path), "%s/%s/%s", DP_BASE_PATH, if_name, DP_UDS_SOCK);
+		/* The UDS path is bounded by sun_path, not by PATH_MAX. */
+		ret = get_dflt_dp_path(dp_path,
+				RTE_SIZEOF_FIELD(struct sockaddr_un, sun_path),
+				if_name, DP_UDS_SOCK);
+		if (ret < 0)
+			return ret;
 		AF_XDP_LOG_LINE(INFO, "'%s' parameter not provided, setting value to '%s'",
 			ETH_AF_XDP_DP_PATH_ARG, dp_path);
 	}
 
 	if (use_pinned_map && !strnlen(dp_path, PATH_MAX)) {
-		snprintf(dp_path, sizeof(dp_path), "%s/%s/%s", DP_BASE_PATH, if_name, DP_XSK_MAP);
+		ret = get_dflt_dp_path(dp_path, sizeof(dp_path), if_name, DP_XSK_MAP);
+		if (ret < 0)
+			return ret;
 		AF_XDP_LOG_LINE(INFO, "'%s' parameter not provided, setting value to '%s'",
 			ETH_AF_XDP_DP_PATH_ARG, dp_path);
 	}
@@ -2561,9 +2616,15 @@ rte_pmd_af_xdp_probe(struct rte_vdev_device *dev)
 		return -EINVAL;
 	}
 
-	if (strlen(if_name) == 0) {
-		AF_XDP_LOG_LINE(ERR, "Network interface must be specified");
-		return -EINVAL;
+	/*
+	 * The socket address is copied into sun_path which is much shorter than
+	 * PATH_MAX, reject an oversized path instead of silently truncating it.
+	 */
+	if (use_cni && strnlen(dp_path, PATH_MAX) >=
+		       RTE_SIZEOF_FIELD(struct sockaddr_un, sun_path)) {
+		AF_XDP_LOG_LINE(ERR, "'%s' value '%s' is too long for a unix socket address",
+				ETH_AF_XDP_DP_PATH_ARG, dp_path);
+		return -ENAMETOOLONG;
 	}
 
 	/* get numa node id from net sysfs */
-- 
2.34.1