On Tue, 3 Nov 2026 at 12:58, Robin Jarry <[email protected]> wrote: > > When an interface is moved to another namespace, the LSC netlink socket > is recreated in the new namespace and the interrupt handle FD is updated > in place. The old socket is never closed, leaking one FD per move. > > Create the new socket first, then close the previous one before updating > the handle, so that the handle never references a closed FD if socket > creation fails. > > Fixes: aae3a38e9e03 ("net/tap: detect namespace change") > Cc: [email protected] > > Signed-off-by: Robin Jarry <[email protected]> > --- > drivers/net/tap/rte_eth_tap.c | 10 ++++++++-- > 1 file changed, 8 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/tap/rte_eth_tap.c b/drivers/net/tap/rte_eth_tap.c > index 1d2b71675a8c..885f1b341388 100644 > --- a/drivers/net/tap/rte_eth_tap.c > +++ b/drivers/net/tap/rte_eth_tap.c > @@ -1938,15 +1938,21 @@ tap_lsc_intr_handle_set(struct rte_eth_dev *dev, int > set) > return 0; > } > if (set) { > + int fd; > + > /* > * Subscribe to RTMGRP_LINK to receive RTM_NEWLINK (link state > * changes) events. Also receives RTM_DELLINK events which are > * used for namespace change detection when TUNGETDEVNETNS is > * available. > */ > - rte_intr_fd_set(pmd->intr_handle, tap_nl_init(RTMGRP_LINK)); > - if (unlikely(rte_intr_fd_get(pmd->intr_handle) == -1)) > + fd = tap_nl_init(RTMGRP_LINK); > + if (unlikely(fd == -1)) > return -EBADF; > + /* Close the socket of the previous namespace, if any. */ > + if (rte_intr_fd_get(pmd->intr_handle) >= 0) > + tap_nl_final(rte_intr_fd_get(pmd->intr_handle)); > + rte_intr_fd_set(pmd->intr_handle, fd); > return rte_intr_callback_register( > pmd->intr_handle, tap_dev_intr_handler, dev); > }
So IIUC, net/tap is changing the FD while the interrupt thread may be working on it. This was working "fine" so far as the interrupt thread was working on a copy, but now, it is racing. This fix looks correct, however, we have more issues following the removal of intr_handle duplication. I would instead make sure the interrupt subsystems acked it stopped caring about this intr_handle (iow, after this callback returns). Btw, I see a use after free on port close (probably missing a intr unregister). I am preparing a different set of fixes (using the same idea than net/virtio-user). -- David Marchand
