[PATCH v5 00/19] net/tap: cleanups, bug fixes, and VLA removal

[Stephen Hemminger]

On Sun, 22 Feb 2026 09:30:35 -0800
Stephen Hemminger <stephen at networkplumber.org> wrote:

> Patches 1-2 are documentation and bug fixes that stand alone: update
> the features matrix to match current driver capabilities, and fix
> queue statistics to count all queues regardless of the queue stat
> counter limit.
> 
> Patch 3 fixes interface name buffers to use IFNAMSIZ instead of
> RTE_ETH_NAME_MAX_LEN, since these are Linux kernel interface names
> not DPDK device names.
> 
> Patches 4-6 are minor cleanups: replace the runtime speed capability
> function with a compile-time constant (TAP is always 10G), clarify
> TUN/TAP flag operator precedence with parentheses, and extend the
> fixed MAC index to 16 bits to avoid duplicates after 256 hot-plug
> cycles.
> 
> Patches 7-12 fix bugs tagged for stable: a bounds check to prevent
> an out-of-bounds read on truncated L4 headers; resource leaks in
> the primary and secondary process probe error paths; a missing free
> of the IPC reply buffer on queue count mismatch; a use-after-free
> with an orphaned kernel TC rule when remote flow creation fails; and
> a leaked remote_flow allocation on EEXIST from an implicit rule.
> 
> Patches 13-18 restructure the driver internals: dynamically allocate
> queue structures instead of embedding fixed-size arrays in
> pmd_internals; replace the pointer-to-VLA iovec with a flexible
> array member sized from MTU and mbuf geometry; replace the Tx
> per-packet VLA with a fixed-size stack array capped at 128 segments;
> remove the VLA in flow item validation; consolidate per-queue
> statistics into a common structure; and enable -Wvla warnings.
> 
> Patch 19 adds a unit test suite for the TAP PMD covering
> configuration, link, stats, MTU, MAC, promisc, allmulti, queue
> start/stop, link up/down, stop/start, and multi-queue.
> 
> v5 - use IFNAMSIZ for interface name buffers
>    - dynamically allocate queue structures
>    - compute Rx scatter segments from MTU instead of nb_rx_desc
>    - use flex array for Rx iovecs, fixed stack array for Tx
>    - consolidate queue statistics
> 
> 
> Stephen Hemminger (19):
>   net/tap: fix handling of queue stats
>   doc: update tap features
>   net/tap: use correct length for interface names
>   net/tap: replace runtime speed capability with constant
>   net/tap: clarify TUN/TAP flag assignment
>   net/tap: extend fixed MAC range to 16 bits
>   net/tap: skip checksum on truncated L4 headers
>   net/tap: fix resource leaks in tap create error path
>   net/tap: fix resource leaks in secondary process probe
>   net/tap: free IPC reply buffer on queue count mismatch
>   net/tap: fix use-after-free on remote flow creation failure
>   net/tap: free remote flow when implicit rule already exists
>   net/tap: dynamically allocate queue structures
>   net/tap: remove VLA in flow item validation
>   net/tap: fix Rx descriptor vs scatter segment confusion
>   net/tap: replace use of VLA in transmit burst
>   net/tap: consolidate queue statistics
>   net/tap: enable VLA warnings
>   test: add unit tests for TAP PMD
> 
>  app/test/meson.build             |    1 +
>  app/test/test_pmd_tap.c          | 1143 ++++++++++++++++++++++++++++++
>  doc/guides/nics/features/tap.ini |   14 +-
>  drivers/net/tap/meson.build      |    1 -
>  drivers/net/tap/rte_eth_tap.c    |  411 ++++++-----
>  drivers/net/tap/rte_eth_tap.h    |   28 +-
>  drivers/net/tap/tap_flow.c       |   36 +-
>  7 files changed, 1424 insertions(+), 210 deletions(-)
>  create mode 100644 app/test/test_pmd_tap.c
> 

Applied to next-net.