[PATCH v12] vhost: fix use-after-free in fdset during shutdown

Yehor Malikov
2026-02-18T09:05:52Z

rte_eal_cleanup() frees hugepage memory while the fdset thread is
still running. Since the fdset structure was allocated with
rte_zmalloc() (hugepage-backed), accessing it after rte_eal_cleanup()
causes use-after-free.

Switch fdset allocation from rte_zmalloc/rte_free to libc
calloc/free. The fdset is a control-path structure that does not
need hugepage memory. Using libc allocation ensures the fdset
remains valid after rte_eal_cleanup() releases hugepages.

Fixes: e68a6feaa3b3 ("vhost: improve fdset initialization")

Signed-off-by: Yehor Malikov <Yehor.Malikov@solidigm.com>
---
.mailmap | 1 +
lib/vhost/fd_man.c | 6 +++---
2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/.mailmap b/.mailmap
index fc53ed2a55..711a6ceff5 100644
--- a/.mailmap
+++ b/.mailmap
@@ -1840,6 +1840,7 @@ Yaroslav Brustinov <ybrustin@cisco.com>
Yash Sharma <ysharma@marvell.com>
Yasufumi Ogawa <ogawa.yasufumi@lab.ntt.co.jp> <yasufum.o@gmail.com>
Yelena Krivosheev <yelena@marvell.com>
+Yehor Malikov <Yehor.Malikov@solidigm.com>
Yerden Zhumabekov <e_zhumabekov@sts.kz> <yerden.zhumabekov@sts.kz>
Yevgeny Kliteynik <kliteyn@nvidia.com>
Yi Chen <chenyi221@huawei.com>
diff --git a/lib/vhost/fd_man.c b/lib/vhost/fd_man.c
index f9147edee7..5748bc31e2 100644
--- a/lib/vhost/fd_man.c
+++ b/lib/vhost/fd_man.c
@@ -4,13 +4,13 @@

#include <errno.h>
#include <stdio.h>
+#include <stdlib.h>
#include <string.h>
#include <sys/epoll.h>
#include <unistd.h>

#include <rte_common.h>
#include <rte_log.h>
-#include <rte_malloc.h>
#include <rte_string_fns.h>
#include <rte_thread.h>

@@ -94,7 +94,7 @@ fdset_init(const char *name)
return fdset;
}

- fdset = rte_zmalloc(NULL, sizeof(*fdset), 0);
+ fdset = calloc(1, sizeof(*fdset));
if (!fdset) {
VHOST_FDMAN_LOG(ERR, "failed to alloc fdset %s", name);
goto err_unlock;
@@ -142,7 +142,7 @@ fdset_init(const char *name)
err_epoll:
close(fdset->epfd);
err_free:
- rte_free(fdset);
+ free(fdset);
err_unlock:
pthread_mutex_unlock(&fdsets_mutex);

--
2.52.0