> From: Maxime Leroy [mailto:[email protected]] On Behalf Of Maxime > Leroy > Sent: Thursday, 11 June 2026 17.49 > > eth_dev_fp_ops_reset() restores a port's fast-path ops on stop/release > via a compound literal, so every field it omits is zeroed to NULL. It > sets only rx_pkt_burst/tx_pkt_burst (and the rxq/txq data), leaving > rx_queue_count, tx_queue_count, rx/tx_descriptor_status, tx_pkt_prepare > and the recycle callbacks NULL. > > In non-debug builds these ops are reached through an unguarded indirect > call (the NULL check exists only under RTE_ETHDEV_DEBUG_RX/TX). So a > thread calling e.g. rte_eth_rx_queue_count() on a port being stopped > dereferences NULL and crashes, while the same race on > rte_eth_rx_burst() > is harmless because the burst ops are reset to dummies. A poll-mode > worker re-checking rx_queue_count before arming the Rx interrupt and > sleeping hits exactly this. > > Reset these ops to the same dummies eth_dev_set_dummy_fops() installs, > so a stopped port behaves like a freshly allocated one: every fast-path > op is a safe no-op, none is NULL. > > Fixes: 066f3d9cc21c ("ethdev: remove callback checks from fast path") > Cc: [email protected] > Signed-off-by: Maxime Leroy <[email protected]> > ---
Good catch. Acked-by: Morten Brørup <[email protected]> Not related to the series, consider sending as separate patch.
