[PATCH v2] net/tap: fix close for partially configured port

David Marchand david.marchand at redhat.com
Fri Mar 27 09:39:02 CET 2026


In case no rxq has been set up (like when starting testpmd with no mempool
drivers), a crash happens in tap_dev_close:

Thread 1 "dpdk-testpmd" received signal SIGSEGV, Segmentation fault.
0x00007ffff7fad68b in tap_dev_close (dev=dev at entry=0x4c4a80
	<rte_eth_devices at INTERNAL>) at ../drivers/net/tap/rte_eth_tap.c:1111
1111			struct rx_queue *rxq = dev->data->rx_queues[i];

(gdb) p dev->data->rx_queues
$4 = (void **) 0x0

Fixes: 23e2387b49a1 ("net/tap: allocate queue structures dynamically")

Signed-off-by: David Marchand <david.marchand at redhat.com>
---
Changes since v1:
- as Stephen AI reported, [rt]x_queues array are sized against
  dev->data->nb_[rt]x_queues, so the loop after the 23e2387b49a1 rework
  can go out of bound. Since nb_rx_queues == nb_tx_queues with this
  driver, simply check the number of configured rxq,

---
 drivers/net/tap/rte_eth_tap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/tap/rte_eth_tap.c b/drivers/net/tap/rte_eth_tap.c
index 64b359914b..a5d460a0b3 100644
--- a/drivers/net/tap/rte_eth_tap.c
+++ b/drivers/net/tap/rte_eth_tap.c
@@ -1107,7 +1107,7 @@ tap_dev_close(struct rte_eth_dev *dev)
 	}
 #endif
 
-	for (i = 0; i < RTE_PMD_TAP_MAX_QUEUES; i++) {
+	for (i = 0; i < dev->data->nb_rx_queues; i++) {
 		struct rx_queue *rxq = dev->data->rx_queues[i];
 
 		tap_queue_close(process_private, i);
-- 
2.53.0



More information about the dev mailing list