|SUCCESS| net/memif: fix use after free on listener socket close

dpdklab at iol.unh.edu dpdklab at iol.unh.edu
Wed Nov 4 18:17:09 CET 2026


Test-Label: ai-code-review
Test-Status: SUCCESS
https://dpdk.org/patch/172641

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-11-04

# DPDK Patch Review

## Patch Summary
The patch fixes a use-after-free bug in the memif driver by switching from `rte_intr_callback_unregister()` to `rte_intr_callback_unregister_sync()` when removing a device.

---

## ERRORS

**None identified.**

---

## WARNINGS

**None identified.**

---

## INFO

**Correctness Fix (Positive):**
The patch correctly addresses a race condition where `memif_listener_handler()` could still be executing when the interrupt handle is freed.

Line 1201-1202 (before):
```c
rte_intr_callback_unregister(socket->intr_handle, memif_listener_handler,
    socket);
```

Line 1201-1202 (after):
```c
rte_intr_callback_unregister_sync(socket->intr_handle,
    memif_listener_handler, socket);
```

Using `_sync` ensures the call waits for any active handler to complete before returning, preventing the subsequent `rte_intr_fd_close()` and `rte_intr_instance_free()` from operating on a handle that may still be in use. This eliminates the use-after-free window.

**Minor Style Observation:**
The line break placement changed (moved "socket" parameter to a new line). Both styles are acceptable under DPDK formatting rules; consistency within the function is maintained.

---

Review-Result: CLEAN


More information about the test-report mailing list