Queue interrupt filters receive a pointer to the iflib_filter_info
embedded in the iflib txq/rxq arrays. Detach freed those arrays
before the driver tore down its interrupt handlers in IFDI_DETACH()
and before iflib_free_intr_mem() released the legacy/MSI handler.
Before fb8fcd4bff36 ("iflib: Track queue datapath lifecycle"),
iflib_stop() always disabled device interrupts first, which narrowed
the window. Now iflib_stop() skips IFDI_INTR_DISABLE() for an
already stopped datapath, and admin work running while the interface
is down can re-enable interrupts. A queue interrupt, or a shared
legacy interrupt raised by another device, could then run
iflib_fast_intr_rxtx() on freed memory:
Fatal trap 9: general protection fault while in kernel mode iflib_fast_intr_rxtx() at iflib_fast_intr_rxtx+0x2d intr_event_handle() at intr_event_handle+0xd8
Free the iflib queue structures only after the driver and iflib
have released all interrupt handlers.
Fixes: fb8fcd4bff36 ("iflib: Track queue datapath lifecycle")
Assisted-by: Github Copilot (Claude Sonnet 5)
Signed-off-by: Krzysztof Galazka <krzysztof.galazka@intel.com>