patch 'net/tap: fix crash on Tx queue release after reconfigure' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 10/29/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/9652e285ad9207414609e2380dca3734b29168e9

Thanks.

Luca Boccassi

---
>From 9652e285ad9207414609e2380dca3734b29168e9 Mon Sep 17 00:00:00 2001
From: Maxime Leroy <maxime at leroys.fr>
Date: Mon, 27 Jul 2026 15:54:07 +0200
Subject: [PATCH] net/tap: fix crash on Tx queue release after reconfigure

[ upstream commit e88c46d8dd6b0328d5a9baf2d0a381031dca53a5 ]

tap_tx_queue_release() reads dev->data->rx_queues[qid] to find out whether
the queue file descriptor is still shared with the Rx side. When ethdev
tears both queue arrays down it releases the Rx queues first and frees
dev->data->rx_queues, so the Tx release dereferences a NULL array and the
process crashes.

Both ethdev call sites do that: the reset_queues error path of
rte_eth_dev_configure(), reached whenever the driver rejects a
reconfigure, and rte_eth_dev_internal_reset(), which bonding calls
unconditionally when a member port is removed.

Treat a freed Rx array like an already released Rx queue and close the
file descriptor. tap_rx_queue_release() reads dev->data->tx_queues the
same way; that array is always still allocated when it runs, but guard it
too so both paths stay symmetric.

Fixes: 72ab1dc1598e ("net/tap: do not duplicate file descriptors")

Signed-off-by: Maxime Leroy <maxime at leroys.fr>
---
 drivers/net/tap/rte_eth_tap.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/tap/rte_eth_tap.c b/drivers/net/tap/rte_eth_tap.c
index a8c9f4465fc..f184999d231 100644
--- a/drivers/net/tap/rte_eth_tap.c
+++ b/drivers/net/tap/rte_eth_tap.c
@@ -1200,7 +1200,7 @@ tap_rx_queue_release(struct rte_eth_dev *dev, uint16_t qid)
 	rxq->pool = NULL;
 	rxq->iovecs = NULL;
 
-	if (dev->data->tx_queues[qid] == NULL)
+	if (dev->data->tx_queues == NULL || dev->data->tx_queues[qid] == NULL)
 		tap_queue_close(process_private, qid);
 }
 
@@ -1214,7 +1214,7 @@ tap_tx_queue_release(struct rte_eth_dev *dev, uint16_t qid)
 		return;
 
 	process_private = rte_eth_devices[txq->out_port].process_private;
-	if (dev->data->rx_queues[qid] == NULL)
+	if (dev->data->rx_queues == NULL || dev->data->rx_queues[qid] == NULL)
 		tap_queue_close(process_private, qid);
 }
 
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-10-27 11:43:54.166896501 +0000
+++ 0010-net-tap-fix-crash-on-Tx-queue-release-after-reconfig.patch	2026-10-27 11:43:53.502059077 +0000
@@ -1 +1 @@
-From e88c46d8dd6b0328d5a9baf2d0a381031dca53a5 Mon Sep 17 00:00:00 2001
+From 9652e285ad9207414609e2380dca3734b29168e9 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit e88c46d8dd6b0328d5a9baf2d0a381031dca53a5 ]
+
@@ -23 +24,0 @@
-Cc: stable at dpdk.org
@@ -31 +32 @@
-index b93452f168..eec18a7c97 100644
+index a8c9f4465fc..f184999d231 100644
@@ -34,3 +35,3 @@
-@@ -1170,7 +1170,7 @@ tap_rx_queue_release(struct rte_eth_dev *dev, uint16_t qid)
- 
- 	tap_rxq_pool_free(rxq->pool);
+@@ -1200,7 +1200,7 @@ tap_rx_queue_release(struct rte_eth_dev *dev, uint16_t qid)
+ 	rxq->pool = NULL;
+ 	rxq->iovecs = NULL;
@@ -40,0 +42 @@
+ }
@@ -42,2 +44 @@
- 	rte_free(rxq);
-@@ -1187,7 +1187,7 @@ tap_tx_queue_release(struct rte_eth_dev *dev, uint16_t qid)
+@@ -1214,7 +1214,7 @@ tap_tx_queue_release(struct rte_eth_dev *dev, uint16_t qid)
@@ -49,0 +51 @@
+ }
@@ -51 +52,0 @@
- 	rte_free(txq);