[PATCH v5] vhost: fix use-after-free in fdset during shutdown

Yehor Malikov
2026-02-04T22:01:03Z

rte_eal_cleanup() frees hugepages memory while the fdset thread is
still running, causing use-after-free when accessing the fdset
structure.

Add fdset_deinit() function to stop the dispatch thread by setting
the destroy flag and waiting for thread completion. Resource cleanup
(epoll fd, fdsets array, memory) is intentionally skipped since the
function is only called during process exit when the OS will reclaim
all resources anyway, avoiding potential deadlocks from mutex
operations in destructor context.

Use symmetric RTE_INIT/RTE_FINI constructors and destructors for both
vhost-user and VDUSE fdsets to ensure proper initialization at library
load and cleanup before EAL teardown.

Fixes: e68a6feaa3b3 ("vhost: improve fdset initialization")

Signed-off-by: Yehor Malikov <Yehor.Malikov@solidigm.com>
---
.mailmap | 1 +
lib/vhost/fd_man.c | 16 ++++++++++++++++
lib/vhost/fd_man.h | 1 +
lib/vhost/socket.c | 24 +++++++++++++++++++-----
lib/vhost/vduse.c | 23 ++++++++++++++++++-----
5 files changed, 55 insertions(+), 10 deletions(-)

diff --git a/.mailmap b/.mailmap
index fc53ed2a55..998185a66e 100644
--- a/.mailmap
+++ b/.mailmap
@@ -1839,6 +1839,7 @@ Yaron Illouz <yaroni@radcom.com>
Yaroslav Brustinov <ybrustin@cisco.com>
Yash Sharma <ysharma@marvell.com>
Yasufumi Ogawa <ogawa.yasufumi@lab.ntt.co.jp> <yasufum.o@gmail.com>
+Yehor Malikov <Yehor.Malikov@solidigm.com>
Yelena Krivosheev <yelena@marvell.com>
Yerden Zhumabekov <e_zhumabekov@sts.kz> <yerden.zhumabekov@sts.kz>
Yevgeny Kliteynik <kliteyn@nvidia.com>
diff --git a/lib/vhost/fd_man.c b/lib/vhost/fd_man.c
index f9147edee7..9790c8a586 100644
--- a/lib/vhost/fd_man.c
+++ b/lib/vhost/fd_man.c
@@ -149,6 +149,22 @@ fdset_init(const char *name)
return NULL;
}

+void
+fdset_deinit(struct fdset *pfdset)
+{
+ unsigned int val;
+
+ if (pfdset == NULL)
+ return;
+
+ /* Signal the dispatch thread to stop */
+ pfdset->destroy = true;
+
+ /* Wait for the dispatch thread to exit */
+ if (rte_thread_join(pfdset->tid, &val) != 0)
+ VHOST_FDMAN_LOG(ERR, "Failed to join %s event dispatch thread", pfdset->name);
+}
+
static int
fdset_insert_entry(struct fdset *pfdset, int fd, fd_cb rcb, fd_cb wcb, void *dat)
{
diff --git a/lib/vhost/fd_man.h b/lib/vhost/fd_man.h
index eadcc6fb42..c9e51badaa 100644
--- a/lib/vhost/fd_man.h
+++ b/lib/vhost/fd_man.h
@@ -15,6 +15,7 @@ struct fdset;
typedef void (*fd_cb)(int fd, void *dat, int *close);

struct fdset *fdset_init(const char *name);
+void fdset_deinit(struct fdset *pfdset);

int fdset_add(struct fdset *pfdset, int fd,
fd_cb rcb, fd_cb wcb, void *dat);
diff --git a/lib/vhost/socket.c b/lib/vhost/socket.c
index ae95e7e6b0..b73d3e75a9 100644
--- a/lib/vhost/socket.c
+++ b/lib/vhost/socket.c
@@ -76,6 +76,8 @@ struct vhost_user_connection {
};

#define MAX_VHOST_SOCKET 1024
+#define VHOST_USER_FDSET_NAME "vhost-evt"
+
struct vhost_user {
struct vhost_user_socket *vsockets[MAX_VHOST_SOCKET];
struct fdset *fdset;
@@ -1198,11 +1200,8 @@ rte_vhost_driver_start(const char *path)
vsocket->extbuf, vsocket->linearbuf);

if (vhost_user.fdset == NULL) {
- vhost_user.fdset = fdset_init("vhost-evt");
- if (vhost_user.fdset == NULL) {
- VHOST_CONFIG_LOG(path, ERR, "failed to init Vhost-user fdset");
- return -1;
- }
+ VHOST_CONFIG_LOG(path, ERR, "Vhost-user fdset not initialized");
+ return -1;
}

if (vsocket->is_server)
@@ -1210,3 +1209,18 @@ rte_vhost_driver_start(const char *path)
else
return vhost_user_start_client(vsocket);
}
+
+RTE_INIT(vhost_user_fdset_init)
+{
+ vhost_user.fdset = fdset_init(VHOST_USER_FDSET_NAME);
+ if (vhost_user.fdset == NULL)
+ VHOST_CONFIG_LOG(VHOST_USER_FDSET_NAME, ERR, "failed to init Vhost-user fdset");
+}
+
+RTE_FINI(vhost_user_fdset_fini)
+{
+ if (vhost_user.fdset != NULL) {
+ fdset_deinit(vhost_user.fdset);
+ vhost_user.fdset = NULL;
+ }
+}
diff --git a/lib/vhost/vduse.c b/lib/vhost/vduse.c
index 0b5d158fee..ad0588ef9f 100644
--- a/lib/vhost/vduse.c
+++ b/lib/vhost/vduse.c
@@ -27,6 +27,7 @@

#define VHOST_VDUSE_API_VERSION 0
#define VDUSE_CTRL_PATH "/dev/vduse/control"
+#define VDUSE_FDSET_NAME "vduse-evt"

struct vduse {
struct fdset *fdset;
@@ -685,11 +686,8 @@ vduse_device_create(const char *path, bool compliant_ol_flags, bool extbuf, bool
bool reconnect = false;

if (vduse.fdset == NULL) {
- vduse.fdset = fdset_init("vduse-evt");
- if (vduse.fdset == NULL) {
- VHOST_CONFIG_LOG(path, ERR, "failed to init VDUSE fdset");
- return -1;
- }
+ VHOST_CONFIG_LOG(path, ERR, "VDUSE fdset not initialized");
+ return -1;
}

control_fd = open(VDUSE_CTRL_PATH, O_RDWR);
@@ -942,3 +940,18 @@ vduse_device_destroy(const char *path)

return 0;
}
+
+RTE_INIT(vduse_fdset_init)
+{
+ vduse.fdset = fdset_init(VDUSE_FDSET_NAME);
+ if (vduse.fdset == NULL)
+ VHOST_CONFIG_LOG(VDUSE_FDSET_NAME, ERR, "failed to init VDUSE fdset");
+}
+
+RTE_FINI(vduse_fdset_fini)
+{
+ if (vduse.fdset != NULL) {
+ fdset_deinit(vduse.fdset);
+ vduse.fdset = NULL;
+ }
+}
--
2.52.0