Thanks to visit codestin.com
Credit goes to github.com

Skip to content

fix(vfio): fix VFIO device hot-remove fd leak preventing re-add - #7676

Merged
likebreath merged 2 commits into
cloud-hypervisor:mainfrom
DamianB-BitFlipper:fix/vfio-hot-remove-fd-leak
Feb 11, 2026
Merged

likebreath merged 2 commits into
cloud-hypervisor:mainfrom
DamianB-BitFlipper:fix/vfio-hot-remove-fd-leak

Conversation

@DamianB-BitFlipper

@DamianB-BitFlipper DamianB-BitFlipper commented Feb 7, 2026

Copy link
Copy Markdown
Contributor

Summary

Fixes VFIO GPU hot-remove leaving group and container file descriptors open, causing re-add to fail with "failed to open /dev/vfio/<group> group: Resource busy".

Root Cause

During hot-add, map_mmio_regions() creates Arc<MmapRegion> entries (mmap'd from the VFIO device fd with MAP_SHARED) and clones them into DeviceManager.mmio_regions. When the guest reprograms PCI BARs during boot, move_bar() updates the addresses in VfioPciDevice.common.mmio_regions but not in the DeviceManager's cloned copies.
During hot-remove, eject_device() calls retain() to remove the device's entries from DeviceManager.mmio_regions, comparing by MmioRegion.start address. Since the addresses are desynchronized by move_bar(), the comparison never matches and the entries are never removed. The surviving Arc<MmapRegion> references keep the kernel struct file refcount on the VFIO device fd above zero (via the mmap VMA), even after close(fd). The kernel then refuses VFIO_GROUP_UNSET_CONTAINER with EBUSY because it considers the device still in use.

Fix

Replace the address-based retain() with slot-based matching. UserMemoryRegion.slot numbers are assigned at mmap creation time and are stable across BAR moves, making them a reliable identifier for cleanup.
Two small public methods are added to MmioRegion to expose slot information without changing field visibility.

Disclaimer

As per the contributing guidelines, I thought I should write this here. This bug was debugged using Opus 4.6. The initial patch was also written with the aid of Opus 4.6. The final version was curated by a human (me).

@DamianB-BitFlipper
DamianB-BitFlipper marked this pull request as ready for review February 7, 2026 04:09
@DamianB-BitFlipper
DamianB-BitFlipper requested a review from a team as a code owner February 7, 2026 04:09
@phip1611
phip1611 self-requested a review February 7, 2026 06:41

@rbradford rbradford left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for your submission. Please check the CONTRIBUTING.md guidelines.

@DamianB-BitFlipper
DamianB-BitFlipper force-pushed the fix/vfio-hot-remove-fd-leak branch from 9d3c053 to 73b0bf2 Compare February 8, 2026 01:53
@DamianB-BitFlipper

Copy link
Copy Markdown
Contributor Author

@rbradford I updated the PR to match the contributing guidelines and also wrote a disclaimer in the description.

@phip1611 phip1611 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks for your contribution!

Left 2 remarks

Comment thread pci/src/vfio.rs Outdated
Comment thread vmm/src/device_manager.rs Outdated

@likebreath likebreath left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the reporting and fixing the bug. Very nice write-up and PR. One suggestion below.

Comment thread pci/src/vfio.rs Outdated
Comment thread pci/src/vfio.rs
@DamianB-BitFlipper
DamianB-BitFlipper force-pushed the fix/vfio-hot-remove-fd-leak branch from 026dd2c to a857220 Compare February 9, 2026 22:21
Comment thread vmm/src/device_manager.rs Outdated
@DamianB-BitFlipper

Copy link
Copy Markdown
Contributor Author

@likebreath Would like your review once more. Feel free to merge if everything checks out on your end. Tested it on my side and it works!

@likebreath

Copy link
Copy Markdown
Member

@likebreath Would like your review once more. Feel free to merge if everything checks out on your end. Tested it on my side and it works!

Good to confirm. Thank you.

What your thought on the following API, which should be simpler and easier to use (single call that compares two instances of MmioRegion?

impl MmioRegion {
    // Returns true if this region has the exact same memory slots as the other region.
    pub fn has_matching_slots(&self, other: &MmioRegion) -> bool
}

Please also cleanup the commit history so that it only contains changes for the final solution.

@DamianB-BitFlipper
DamianB-BitFlipper force-pushed the fix/vfio-hot-remove-fd-leak branch from 1ceaf04 to 1e3d1aa Compare February 10, 2026 19:55
@DamianB-BitFlipper

Copy link
Copy Markdown
Contributor Author

Ok. Cleaned up history, changed the API and tested. Works.

@likebreath likebreath left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall looking good.

Last nit: Can you please also cleanup the commit message in the same way - so that it only explain the final change (without context of previous iterations). Thanks a lot!

@likebreath likebreath added the bug-fix Bug fix to include in release notes label Feb 10, 2026
Change has_matching_slots() to compare two MmioRegion instances
directly rather than requiring callers to construct an intermediate
HashSet of slot numbers. Remove the now-unused
user_memory_region_slots() method and HashSet import.

Signed-off-by: Damian Barabonkov <[email protected]>
When a VFIO device with multiple MMIO regions is hot-unplugged, each
region must be individually matched and removed from the DeviceManager's
mmio_regions list. Compare per-region rather than building an aggregate
across all regions, which would never match any individual entry.

Also remove the now-unused HashSet import.

Signed-off-by: Damian Barabonkov <[email protected]>
@DamianB-BitFlipper

Copy link
Copy Markdown
Contributor Author

How about now?

@likebreath likebreath left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I appreciate your persistence on this. Thanks again for the contribution—this is an important bug fix.

@likebreath
likebreath enabled auto-merge February 10, 2026 20:33
@DamianB-BitFlipper

Copy link
Copy Markdown
Contributor Author

When might it be released?

@likebreath
likebreath added this pull request to the merge queue Feb 10, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to no response for status checks Feb 10, 2026
@likebreath
likebreath added this pull request to the merge queue Feb 11, 2026
Merged via the queue into cloud-hypervisor:main with commit dde5f6e Feb 11, 2026
43 checks passed
@github-project-automation github-project-automation Bot moved this from 🆕 New to ✅ Done in Cloud Hypervisor Roadmap Feb 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug-fix Bug fix to include in release notes

Projects

Status: ✅ Done

Development

Successfully merging this pull request may close these issues.

4 participants