|SUCCESS| [v2] net/memif: fix use after free on listener socket close

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: SUCCESS
https://dpdk.org/patch/172699

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-11-06

# DPDK Patch Review

## ERRORS

None identified.

## WARNINGS

None identified.

## INFO

**Code structure observation:**

The patch correctly addresses a use-after-free race by using `rte_intr_callback_unregister_sync()` instead of `rte_intr_callback_unregister()`. This ensures the callback handler completes before the interrupt handle is closed and freed.

The fix is applied consistently in both error cleanup (line 1129) and normal removal (line 1201) paths, which is the correct pattern.

**Verification of the fix:**

Line 1129 (error path in `memif_socket_init`):
```c
rte_intr_callback_unregister_sync(socket->intr_handle,
    memif_listener_handler, socket);
```

Line 1201 (normal path in `memif_socket_remove_device`):
```c
rte_intr_callback_unregister_sync(socket->intr_handle,
    memif_listener_handler, socket);
```

Both are followed by:
```c
rte_intr_fd_close(socket->intr_handle);
rte_intr_instance_free(socket->intr_handle);
```

The synchronous unregister prevents the handler from accessing the handle after it has been freed, which was the original bug described in the commit message.

Review-Result: CLEAN