|SUCCESS| net/memif: fix use after free on listener socket close
dpdklab at iol.unh.edu
dpdklab at iol.unh.edu
Wed Nov 4 18:17:09 CET 2026
Test-Label: ai-code-review
Test-Status: SUCCESS
https://dpdk.org/patch/172641
_AI Code Review_
=== Patch Review: series.patch (via Claude) ===
Review date: 2026-11-04
# DPDK Patch Review
## Patch Summary
The patch fixes a use-after-free bug in the memif driver by switching from `rte_intr_callback_unregister()` to `rte_intr_callback_unregister_sync()` when removing a device.
---
## ERRORS
**None identified.**
---
## WARNINGS
**None identified.**
---
## INFO
**Correctness Fix (Positive):**
The patch correctly addresses a race condition where `memif_listener_handler()` could still be executing when the interrupt handle is freed.
Line 1201-1202 (before):
```c
rte_intr_callback_unregister(socket->intr_handle, memif_listener_handler,
socket);
```
Line 1201-1202 (after):
```c
rte_intr_callback_unregister_sync(socket->intr_handle,
memif_listener_handler, socket);
```
Using `_sync` ensures the call waits for any active handler to complete before returning, preventing the subsequent `rte_intr_fd_close()` and `rte_intr_instance_free()` from operating on a handle that may still be in use. This eliminates the use-after-free window.
**Minor Style Observation:**
The line break placement changed (moved "socket" parameter to a new line). Both styles are acceptable under DPDK formatting rules; consistency within the function is maintained.
---
Review-Result: CLEAN
More information about the test-report
mailing list