vdpa: fix use-after-free of vqs in vhost_vdpa_device_unrealize
vhost_vdpa_device_unrealize() frees s->dev.vqs before vhost_dev_cleanup(), but vhost_dev_cleanup() still accesses hdev->vqs while tearing down virtqueues. This leads to a use-after-free and may crash QEMU with SIGSEGV during vDPA hot-unplug. Save the vqs pointer in a local variable, call vhost_dev_cleanup(), and free it afterward. This matches the cleanup pattern used by vhost-scsi. Fixes: b430a2bd23 ("vdpa: add vdpa-dev support") Co-developed-by: Miao Kezhan <miaokezhan@baidu.com> Signed-off-by: Li Zhaoxin <lizhaoxin04@baidu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <20260622100145.18924-1-lizhaoxin04@baidu.com>
lizhaoxin04 committed
Jun 22, 2026 at 18:01 UTC
e03463812e74d1befc8d7f6f158eca531e2d6406
1 file changed
+2
-1
hw/virtio/vdpa-dev.c
+2
-1
@@ -172,6 +172,7 @@ static void vhost_vdpa_device_unrealize(DeviceState *dev)
172
{
173
VirtIODevice *vdev = VIRTIO_DEVICE(dev);
174
VhostVdpaDevice *s = VHOST_VDPA_DEVICE(vdev);
175
+ struct vhost_virtqueue *vqs = s->dev.vqs;
176
int i;
177
178
virtio_set_status(vdev, 0);
@@ -183,8 +184,8 @@ static void vhost_vdpa_device_unrealize(DeviceState *dev)
184
virtio_cleanup(vdev);
185
186
g_free(s->config);
186
- g_free(s->dev.vqs);
187
vhost_dev_cleanup(&s->dev);
188
+ g_free(vqs);
189
g_free(s->vdpa.shared);
190
qemu_close(s->vhostfd);
191
s->vhostfd = -1;