patch 'net/memif: disconnect on device close' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 11/07/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/7ec68e47105e9aee0cac265f27207d2a5acb2a63

Thanks.

Luca Boccassi

---
>From 7ec68e47105e9aee0cac265f27207d2a5acb2a63 Mon Sep 17 00:00:00 2001
From: Sriram Yagnaraman <sriram.yagnaraman at ericsson.com>
Date: Fri, 16 Oct 2026 21:58:55 +0200
Subject: [PATCH] net/memif: disconnect on device close

[ upstream commit ef08e3038d5a2bcffbf2e68c3f09a50db928e720 ]

memif_dev_close() enqueued a disconnect message but never flushed it and
never tore down the control channel, leaking the control-channel
interrupt callback, its file descriptor and the pmd->cc allocation.

A server that was started and then stopped could still accept a peer and
hold a live pmd->cc at close. Call memif_disconnect() from close to flush
the queued disconnect and release the control channel; it is guarded on
pmd->cc and clears it, so it is safe when dev_stop already ran, and it is
a backstop for an init that races with stop. The companion fix that makes
dev_stop refuse peers removes the common trigger.

memif_disconnect() also walked the per-queue interrupt handles indexed
by the configured ring count without checking that the queue pointer was
set. Closing a device that was configured but never started (so queues
were never allocated) then dereferenced a NULL queue; skip NULL queue
entries.

Fixes: 09c7e63a71f9 ("net/memif: introduce memory interface PMD")

Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman at ericsson.com>
---
 drivers/net/memif/memif_socket.c  | 6 ++++++
 drivers/net/memif/rte_eth_memif.c | 4 ++++
 2 files changed, 10 insertions(+)

diff --git a/drivers/net/memif/memif_socket.c b/drivers/net/memif/memif_socket.c
index 1eb71ee0458..b6a0da0f475 100644
--- a/drivers/net/memif/memif_socket.c
+++ b/drivers/net/memif/memif_socket.c
@@ -664,6 +664,9 @@ memif_disconnect(struct rte_eth_dev *dev)
 				continue;
 		}
 
+		if (mq == NULL)
+			continue;
+
 		if (rte_intr_fd_get(mq->intr_handle) > 0) {
 			close(rte_intr_fd_get(mq->intr_handle));
 			rte_intr_fd_set(mq->intr_handle, -1);
@@ -682,6 +685,9 @@ memif_disconnect(struct rte_eth_dev *dev)
 				continue;
 		}
 
+		if (mq == NULL)
+			continue;
+
 		if (rte_intr_fd_get(mq->intr_handle) > 0) {
 			close(rte_intr_fd_get(mq->intr_handle));
 			rte_intr_fd_set(mq->intr_handle, -1);
diff --git a/drivers/net/memif/rte_eth_memif.c b/drivers/net/memif/rte_eth_memif.c
index 825c6e9b277..856dc165d50 100644
--- a/drivers/net/memif/rte_eth_memif.c
+++ b/drivers/net/memif/rte_eth_memif.c
@@ -1721,6 +1721,10 @@ memif_dev_close(struct rte_eth_dev *dev)
 
 	if (rte_eal_process_type() == RTE_PROC_PRIMARY) {
 		memif_msg_enq_disconnect(pmd->cc, "Device closed", 0);
+		/* Flush the disconnect and tear down the control channel;
+		 * memif_disconnect() is idempotent if dev_stop already ran.
+		 */
+		memif_disconnect(dev);
 
 		for (i = 0; i < dev->data->nb_rx_queues; i++)
 			(*dev->dev_ops->rx_queue_release)(dev, i);
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-11-05 16:42:48.084144691 +0000
+++ 0082-net-memif-disconnect-on-device-close.patch	2026-11-05 16:42:45.017063655 +0000
@@ -1 +1 @@
-From ef08e3038d5a2bcffbf2e68c3f09a50db928e720 Mon Sep 17 00:00:00 2001
+From 7ec68e47105e9aee0cac265f27207d2a5acb2a63 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit ef08e3038d5a2bcffbf2e68c3f09a50db928e720 ]
+
@@ -24 +25,0 @@
-Cc: stable at dpdk.org
@@ -33 +34 @@
-index e5a1249a9c..971964133c 100644
+index 1eb71ee0458..b6a0da0f475 100644
@@ -43,4 +44,4 @@
- 		rte_intr_fd_close(mq->intr_handle);
- 	}
- 	for (i = 0; i < pmd->cfg.num_s2c_rings; i++) {
-@@ -679,6 +682,9 @@ memif_disconnect(struct rte_eth_dev *dev)
+ 		if (rte_intr_fd_get(mq->intr_handle) > 0) {
+ 			close(rte_intr_fd_get(mq->intr_handle));
+ 			rte_intr_fd_set(mq->intr_handle, -1);
+@@ -682,6 +685,9 @@ memif_disconnect(struct rte_eth_dev *dev)
@@ -53,3 +54,3 @@
- 		rte_intr_fd_close(mq->intr_handle);
- 	}
- 
+ 		if (rte_intr_fd_get(mq->intr_handle) > 0) {
+ 			close(rte_intr_fd_get(mq->intr_handle));
+ 			rte_intr_fd_set(mq->intr_handle, -1);
@@ -57 +58 @@
-index 852a7e2e8e..cdf77d77b0 100644
+index 825c6e9b277..856dc165d50 100644
@@ -60 +61 @@
-@@ -1723,6 +1723,10 @@ memif_dev_close(struct rte_eth_dev *dev)
+@@ -1721,6 +1721,10 @@ memif_dev_close(struct rte_eth_dev *dev)
@@ -70 +71 @@
- 			memif_rx_queue_release(dev, i);
+ 			(*dev->dev_ops->rx_queue_release)(dev, i);