[PATCH dpdk] net/tap: close old LSC socket on netns change

[David Marchand]

On Tue, 3 Nov 2026 at 12:58, Robin Jarry <rjarry at redhat.com> wrote:
>
> When an interface is moved to another namespace, the LSC netlink socket
> is recreated in the new namespace and the interrupt handle FD is updated
> in place. The old socket is never closed, leaking one FD per move.
>
> Create the new socket first, then close the previous one before updating
> the handle, so that the handle never references a closed FD if socket
> creation fails.
>
> Fixes: aae3a38e9e03 ("net/tap: detect namespace change")
> Cc: stable at dpdk.org
>
> Signed-off-by: Robin Jarry <rjarry at redhat.com>
> ---
>  drivers/net/tap/rte_eth_tap.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/tap/rte_eth_tap.c b/drivers/net/tap/rte_eth_tap.c
> index 1d2b71675a8c..885f1b341388 100644
> --- a/drivers/net/tap/rte_eth_tap.c
> +++ b/drivers/net/tap/rte_eth_tap.c
> @@ -1938,15 +1938,21 @@ tap_lsc_intr_handle_set(struct rte_eth_dev *dev, int set)
>                 return 0;
>         }
>         if (set) {
> +               int fd;
> +
>                 /*
>                  * Subscribe to RTMGRP_LINK to receive RTM_NEWLINK (link state
>                  * changes) events. Also receives RTM_DELLINK events which are
>                  * used for namespace change detection when TUNGETDEVNETNS is
>                  * available.
>                  */
> -               rte_intr_fd_set(pmd->intr_handle, tap_nl_init(RTMGRP_LINK));
> -               if (unlikely(rte_intr_fd_get(pmd->intr_handle) == -1))
> +               fd = tap_nl_init(RTMGRP_LINK);
> +               if (unlikely(fd == -1))
>                         return -EBADF;
> +               /* Close the socket of the previous namespace, if any. */
> +               if (rte_intr_fd_get(pmd->intr_handle) >= 0)
> +                       tap_nl_final(rte_intr_fd_get(pmd->intr_handle));
> +               rte_intr_fd_set(pmd->intr_handle, fd);
>                 return rte_intr_callback_register(
>                         pmd->intr_handle, tap_dev_intr_handler, dev);
>         }

So IIUC, net/tap is changing the FD while the interrupt thread may be
working on it.
This was working "fine" so far as the interrupt thread was working on
a copy, but now, it is racing.

This fix looks correct, however, we have more issues following the
removal of intr_handle duplication.
I would instead make sure the interrupt subsystems acked it stopped
caring about this intr_handle (iow, after this callback returns).
Btw, I see a use after free on port close (probably missing a intr unregister).

I am preparing a different set of fixes (using the same idea than
net/virtio-user).


-- 
David Marchand