[PATCH] net/af_xdp: fix resource leak in eth_dev_close

[Stephen Hemminger]

On Tue,  7 Apr 2026 10:14:28 +0800
"Ouyang Hao" <ouyanghao at tencent.com> wrote:

> The rx_queues and tx_queues arrays are allocated as contiguous
> blocks via rte_zmalloc_socket() in init_internals(). However,
> eth_dev_close() incorrectly calls rte_free() on individual array
> elements (rxq and rxq->pair) inside the per-queue cleanup loop.
> 
> Since rte_free(&rx_queues[0]) releases the entire contiguous
> block, the memory backing queues[1..N-1] becomes invalid after
> the first iteration. On subsequent iterations, accessing the
> freed memory may read NULL (or garbage), causing the loop to
> break early via the (rxq->umem == NULL) check.
> 
> This results in:
> - XSK sockets for queues 1..N-1 not being deleted
> - UMEM reference counts not being decremented, leaking memory
> - Potential use-after-free if freed memory is reallocated
> 
> Fix by removing the per-element rte_free() calls from inside
> the loop and instead freeing the entire tx_queues and rx_queues
> arrays after the loop completes.
> 
> Fixes: 339b88c6a91f ("net/af_xdp: support multi-queue")
> Cc: stable at dpdk.org
> 
> Signed-off-by: Ouyang Hao <ouyanghao at tencent.com>
> ---

Applied to next-net, added your email to the .mailmap