[PATCH] net/af_packet: fix crash in secondary process

[PATCH] net/af_packet: fix crash in secondary process

[Kerem Aksu]

dumpcap crashes when trying to capture from af_packet devices. This is
caused by allocating interface name with
strdup (i.e. malloc). Interface name is not accessible from secondary
process and causes segmentation fault. Use rte_malloc instead of
strdup to fix the issue.

Bugzilla ID: 1786
Fixes: 1b93c2aa81b4 ("net/af_packet: add interface name to internals")
Cc: stable@dpdk.org

Reported-by: Kerem Aksu <kerem.aksu@i2i-systems.com>
Signed-off-by: Kerem Aksu <kerem.aksu@i2i-systems.com>
---
 .mailmap                                  | 1 +
 drivers/net/af_packet/rte_eth_af_packet.c | 9 ++++++---
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.mailmap b/.mailmap
index 73d573e400..fadf873d4f 100644
--- a/.mailmap
+++ b/.mailmap
@@ -824,6 +824,7 @@ Kefu Chai <tchaikov@gmail.com>
 Keiichi Watanabe <keiichiw@chromium.org>
 Keith Wiles <keith.wiles@intel.com> <keith.wiles@windriver.com>
 Kent Wires <kent.wires@intel.com>
+Kerem Aksu <kerem.aksu@i2i-systems.com>
 Keunhong Lee <dlrmsghd@gmail.com>
 Kevin Laatz <kevin.laatz@intel.com>
 Kevin Lampis <klampis@solarflare.com>
diff --git a/drivers/net/af_packet/rte_eth_af_packet.c b/drivers/net/af_packet/rte_eth_af_packet.c
index 85bc1201b4..6928fc200f 100644
--- a/drivers/net/af_packet/rte_eth_af_packet.c
+++ b/drivers/net/af_packet/rte_eth_af_packet.c
@@ -525,7 +525,7 @@ eth_dev_close(struct rte_eth_dev *dev)
 		rte_free(internals->rx_queue[q].rd);
 		rte_free(internals->tx_queue[q].rd);
 	}
-	free(internals->if_name);
+	rte_free(internals->if_name);
 	rte_free(internals->rx_queue);
 	rte_free(internals->tx_queue);
 
@@ -875,9 +875,12 @@ rte_pmd_init_internals(struct rte_vdev_device *dev,
 		PMD_LOG_ERRNO(ERR, "%s: ioctl failed (SIOCGIFINDEX)", name);
 		goto free_internals;
 	}
-	(*internals)->if_name = strdup(pair->value);
+	(*internals)->if_name = rte_zmalloc_socket(name, ifnamelen + 1,
+									0, numa_node);
 	if ((*internals)->if_name == NULL)
 		goto free_internals;
+	memcpy((*internals)->if_name, pair->value, ifnamelen);
+	(*internals)->if_name[ifnamelen] = '\0';
 	(*internals)->if_index = ifr.ifr_ifindex;
 
 	if (ioctl(sockfd, SIOCGIFHWADDR, &ifr) == -1) {
@@ -1063,7 +1066,7 @@ rte_pmd_init_internals(struct rte_vdev_device *dev,
 free_internals:
 	rte_free((*internals)->rx_queue);
 	rte_free((*internals)->tx_queue);
-	free((*internals)->if_name);
+	rte_free((*internals)->if_name);
 	rte_free(*internals);
 	return -1;
 }
-- 
2.34.1


-- 
Yasal Uyarı: *Bu elektronik posta bu linki kullanarak ulaşabileceğiniz 
koşullara tabidir:** **https://i2i-systems.com/email-disclaimer/ 
<http://i2i-systems.com/about-us/email-disclaimer/>*

Re: [PATCH] net/af_packet: fix crash in secondary process

[Thomas Monjalon]

12/09/2025 10:47, Kerem Aksu:
> dumpcap crashes when trying to capture from af_packet devices. This is
> caused by allocating interface name with
> strdup (i.e. malloc). Interface name is not accessible from secondary
> process and causes segmentation fault. Use rte_malloc instead of
> strdup to fix the issue.

I agree with the analysis, thank you.

[...]
> -	(*internals)->if_name = strdup(pair->value);
> +	(*internals)->if_name = rte_zmalloc_socket(name, ifnamelen + 1,
> +									0, numa_node);

Probably no need to go on the next line, you are allowed to go to 100 characters per line.
If a second line is needed, only 2 tabs are required.

Why zmalloc? Probably no need to zero it.

>  	if ((*internals)->if_name == NULL)
>  		goto free_internals;
> +	memcpy((*internals)->if_name, pair->value, ifnamelen);
> +	(*internals)->if_name[ifnamelen] = '\0';

We can use a string-specialized function, like strlcpy.

Re: [PATCH] net/af_packet: fix crash in secondary process

[Kerem Aksu]

[-- Attachment #1: Type: text/plain, Size: 737 bytes --]

> Probably no need to go on the next line, you are allowed to go to 100
characters per line.
> If a second line is needed, only 2 tabs are required.
>
> Why zmalloc? Probably no need to zero it.

I figured since it was only IFNAMSIZ bytes it wouldn't matter because
this will run once at startup. I can use rte_malloc instead.

> We can use a string-specialized function, like strlcpy.

I used memcpy because it was used before this line for the same exact job.

Will post another patch with rte_malloc and strlcpy.

-- 
Yasal Uyarı: *Bu elektronik posta bu linki kullanarak ulaşabileceğiniz 
koşullara tabidir:** **https://i2i-systems.com/email-disclaimer/ 
<http://i2i-systems.com/about-us/email-disclaimer/>*

[-- Attachment #2: Type: text/html, Size: 1401 bytes --]

[PATCH v2] net/af_packet: fix crash in secondary process

[Kerem Aksu]

dumpcap crashes when trying to capture from af_packet devices. This is
caused by allocating interface name with
strdup (i.e. malloc). Interface name is not accessible from secondary
process and causes segmentation fault. Use rte_malloc instead of
strdup to fix the issue.

Bugzilla ID: 1786
Fixes: 1b93c2aa81b4 ("net/af_packet: add interface name to internals")
Cc: stable@dpdk.org

Reported-by: Kerem Aksu <kerem.aksu@i2i-systems.com>
Signed-off-by: Kerem Aksu <kerem.aksu@i2i-systems.com>
---
 .mailmap                                  | 1 +
 drivers/net/af_packet/rte_eth_af_packet.c | 7 ++++---
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/.mailmap b/.mailmap
index 6303e7878e..bdb4e06dbb 100644
--- a/.mailmap
+++ b/.mailmap
@@ -824,6 +824,7 @@ Kefu Chai <tchaikov@gmail.com>
 Keiichi Watanabe <keiichiw@chromium.org>
 Keith Wiles <keith.wiles@intel.com> <keith.wiles@windriver.com>
 Kent Wires <kent.wires@intel.com>
+Kerem Aksu <kerem.aksu@i2i-systems.com>
 Keunhong Lee <dlrmsghd@gmail.com>
 Kevin Laatz <kevin.laatz@intel.com>
 Kevin Lampis <klampis@solarflare.com>
diff --git a/drivers/net/af_packet/rte_eth_af_packet.c b/drivers/net/af_packet/rte_eth_af_packet.c
index 85bc1201b4..de7ff63527 100644
--- a/drivers/net/af_packet/rte_eth_af_packet.c
+++ b/drivers/net/af_packet/rte_eth_af_packet.c
@@ -525,7 +525,7 @@ eth_dev_close(struct rte_eth_dev *dev)
 		rte_free(internals->rx_queue[q].rd);
 		rte_free(internals->tx_queue[q].rd);
 	}
-	free(internals->if_name);
+	rte_free(internals->if_name);
 	rte_free(internals->rx_queue);
 	rte_free(internals->tx_queue);
 
@@ -875,9 +875,10 @@ rte_pmd_init_internals(struct rte_vdev_device *dev,
 		PMD_LOG_ERRNO(ERR, "%s: ioctl failed (SIOCGIFINDEX)", name);
 		goto free_internals;
 	}
-	(*internals)->if_name = strdup(pair->value);
+	(*internals)->if_name = rte_malloc_socket(name, ifnamelen + 1, 0, numa_node);
 	if ((*internals)->if_name == NULL)
 		goto free_internals;
+	strlcpy((*internals)->if_name, pair->value, ifnamelen + 1);
 	(*internals)->if_index = ifr.ifr_ifindex;
 
 	if (ioctl(sockfd, SIOCGIFHWADDR, &ifr) == -1) {
@@ -1063,7 +1064,7 @@ rte_pmd_init_internals(struct rte_vdev_device *dev,
 free_internals:
 	rte_free((*internals)->rx_queue);
 	rte_free((*internals)->tx_queue);
-	free((*internals)->if_name);
+	rte_free((*internals)->if_name);
 	rte_free(*internals);
 	return -1;
 }
-- 
2.34.1


-- 
Yasal Uyarı: *Bu elektronik posta bu linki kullanarak ulaşabileceğiniz 
koşullara tabidir:** **https://i2i-systems.com/email-disclaimer/ 
<http://i2i-systems.com/about-us/email-disclaimer/>*