|SUCCESS| [v2] net/memif: fix use after free on listener socket close

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: SUCCESS
https://dpdk.org/patch/172699

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-11-06

# DPDK Patch Review

## Patch Summary
This patch fixes a use-after-free issue in the memif driver by replacing `rte_intr_callback_unregister()` with `rte_intr_callback_unregister_sync()` to ensure interrupt handlers complete before resources are freed.

## Review

### ERRORS

None identified.

### WARNINGS

None identified.

### INFO

**Evidence-based correctness analysis:**

The patch correctly addresses a use-after-free scenario:

1. **Root cause identified:** Line 1201 shows `rte_intr_callback_unregister(socket->intr_handle, memif_listener_handler, socket);` which can return -EAGAIN if the handler is active, but the code proceeds to close/free the handle (lines 1202-1203) regardless of return value.

2. **Fix is appropriate:** Replacing with `rte_intr_callback_unregister_sync()` (lines 1201-1202 in new code) ensures the function retries until `memif_listener_handler()` completes, preventing use-after-free.

3. **Consistency:** The patch correctly updates both call sites (lines 1129 and 1201 in the original code) where the listener socket interrupt is unregistered, ensuring uniform protection against the race condition.

4. **API usage:** `rte_intr_callback_unregister_sync()` is the documented API for this pattern - unregistering callbacks before freeing associated resources.

**Code correctness:** The error path at line 1129 (init failure) and the cleanup path at line 1201 (device removal) both follow the same pattern: unregister - close fd - free handle. Using the sync variant prevents the handler from accessing freed memory in both cases.

**Style compliance:** Code follows DPDK style - proper indentation, line continuation formatting, and API usage.

Review-Result: CLEAN