This otherwise causes a use-after-free if network backend cleanup is performed before character device cleanup.
Cc: Marc-André Lureau <marcandre.lur...@redhat.com> Signed-off-by: Paolo Bonzini <pbonz...@redhat.com> --- I'm including this in the pull request too. net/vhost-user.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/vhost-user.c b/net/vhost-user.c index 636899a..92f4cfd 100644 --- a/net/vhost-user.c +++ b/net/vhost-user.c @@ -151,6 +151,11 @@ static void vhost_user_cleanup(NetClientState *nc) vhost_net_cleanup(s->vhost_net); s->vhost_net = NULL; } + if (s->chr) { + qemu_chr_add_handlers(s->chr, NULL, NULL, NULL, NULL); + qemu_chr_fe_release(s->chr); + s->chr = NULL; + } qemu_purge_queued_packets(nc); } -- 1.8.3.1