## Host environment - Operating system: Linux - OS/kernel version: Linux 6.8.0-101-generic x86_64 - Architecture: x86_64 - QEMU flavor: qemu-system-i386 - QEMU version: QEMU emulator version 11.0.0 (v11.0.0) - QEMU command line: ``` LSAN_OPTIONS=fast_unwind_on_malloc=0 qemu-system-i386 \ -display none -machine accel=qtest, -m 512M -machine pc -nodefaults \ -device virtio-gpu-pci,id=fdev_virtio_gpu --trace "*virt*" \ -qtest tcp:127.0.0.1:44445,server=on,wait=off \ -monitor tcp:127.0.0.1:44446,server=on,wait=off ``` ## Emulated/Virtualized environment - Operating system: N/A - OS/kernel version: N/A - Architecture: N/A ## Description of problem A memory leak occurs in `virtio_gpu_handle_ctrl` at `hw/display/virtio-gpu.c:1124` and `hw/display/virtio-gpu.c:1130` when guest-controlled virtqueue commands cause `virtqueue_pop` to map guest DMA descriptors via `address_space_map`. The function acquires these DMA mappings but does not release them on certain error or reset paths, leaking 2240 bytes across 64 allocations per reproducer run. Reproducing this bug requires sending qtest commands and monitor commands in sequence (see steps below). ## Steps to reproduce - The full reproduction steps and command sequences are included in the attached [repro.sh](/uploads/3b5be23c05f137170d11d07798625f6e/repro.sh) file; simply running that script reproduces the issue. 1. Start QEMU with the below command (**LeakSanitizer build required**): ```sh LSAN_OPTIONS=fast_unwind_on_malloc=0 qemu-system-i386 \ -display none -machine accel=qtest, -m 512M -machine pc -nodefaults \ -device virtio-gpu-pci,id=fdev_virtio_gpu --trace "*virt*" \ -qtest tcp:127.0.0.1:44445,server=on,wait=off \ -monitor tcp:127.0.0.1:44446,server=on,wait=off & sleep 1 ``` 2. Send qtest commands through the qtest socket ```sh cat <<'EOF' | nc -N 127.0.0.1 44445 outl 0xcf8 0x80001000 inw 0xcfc outl 0xcf8 0x80001014 outl 0xcfc 0xffffffff outl 0xcf8 0x80001014 inl 0xcfc outl 0xcf8 0x80001014 outl 0xcfc 0xe0000000 outl 0xcf8 0x80001020 outl 0xcfc 0xffffffff outl 0xcf8 0x80001020 inl 0xcfc outl 0xcf8 0x80001020 outl 0xcfc 0xe0004000 outl 0xcf8 0x80001004 inw 0xcfc outl 0xcf8 0x80001004 outw 0xcfc 0x7 outl 0xcf8 0x80001004 inw 0xcfc outl 0xcf8 0x80001034 inb 0xcfc outl 0xcf8 0x80001098 inb 0xcfc outl 0xcf8 0x8000109a inw 0xcfc outl 0xcf8 0x8000109a outw 0xcfc 0x8002 outl 0xcf8 0x8000109c inl 0xcfc outl 0xcf8 0x80001014 outl 0xcfc 0xffffffff outl 0xcf8 0x80001014 inl 0xcfc outl 0xcf8 0x80001014 outl 0xcfc 0xe0008000 outl 0xcf8 0x800010a0 inl 0xcfc readq 0xe000402d readw 0xe000800e writeq 0xe000402b 0x8971b8d writel 0xe0004005 0x1000908 readl 0xe0004001 writel 0xe00060b0 0x399118 readw 0xe0006004 readl 0xe0008804 readl 0xe000640e writel 0xe0007915 0x684f09e4 writel 0xe0008000 0x2a0f9fd1 writeq 0xe000402b 0x8971b8d readw 0xe0006004 writeq 0xe0004014 0x1f977a4a readw 0xe0006004 writeb 0xe0004028 0x28 writel 0xe0007834 0x51415ab9 writeb 0xe0004028 0x28 readw 0xe0008026 readq 0xe00066f5 writeq 0xe0007df1 0xc1cb22d readl 0xe0008804 writeq 0xe0004014 0x1f977a4a writel 0xe0004017 0xc9636a6 writeq 0xe0007df1 0xc1cb22d writel 0xe00060b0 0x399118 writew 0xe0006008 0x440f writeq 0xe0006069 0xc3fca3a writel 0xe0008000 0x2a0f9fd1 writel 0xe0006009 0x1081da01 writeq 0xe0007df1 0xc1cb22d readw 0xe0005715 readq 0xe000402d readl 0xe0008804 readl 0xe000713e readl 0xe000802f writeq 0xe0008806 0x1a7072b0 writeq 0xe0007df1 0xc1cb22d writeq 0xe0006069 0x7bbf2bd0 writew 0xe0006008 0x440f readw 0xe00056f0 writeq 0xe0008801 0x2ab929bd readw 0xe0006004 readl 0xe0008804 writel 0xe00064b2 0x3dfe1619 writel 0xe00060b0 0x3dfe1619 readw 0xe000800e writeq 0xe0004a11 0x7786984e writel 0xe0008000 0x2a0f9fd1 writeq 0xe0007df1 0xc1cb22d writew 0xe0006008 0x440f writeq 0xe0004022 0x155555b4 writel 0xe0008000 0x2a0f9fd1 readl 0xe000802f writeq 0xe0006069 0x7bbf2bd0 writeq 0xe0006069 0x7bbf2bd0 readw 0xe0006004 writel 0xe0008000 0x2a0f9fd1 writeq 0xe0007df1 0xc1cb22d writeq 0xe0006069 0x7bbf2bd0 writel 0xe00064b2 0x3dfe1619 writel 0xe0004017 0xc9636a6 writeq 0xe000400c 0x410421f readl 0xe0008804 writew 0xe0006008 0x440f writeq 0xe0006069 0x7bbf2bd0 writeq 0xe0006069 0x7bbf2bd0 writeq 0xe0008801 0x2ab929bd writew 0xe0007df1 0x5798 readl 0xe00066f7 writel 0xe0006677 0x4b3e365 readl 0xe0008804 writeq 0xe0008801 0x7b75daea writeq 0xe000400c 0x410421f writeq 0xe0008806 0x1a7072b0 readq 0xe0006cdf writeq 0xe0004020 0x10000 writeq 0xe0004028 0x20000 writew 0xe0007df1 0x5798 writew 0xe000401b 0x1b5 writeq 0xe0007001 0x83442d3 write 0x20002 0x2 0xca15 write 0x20003 0x1 0xca read 0x20002 0x2 write 0x10006 0x2 0x0e11 write 0x10008 0x1 0x03 write 0x1000c 0x4 0xa00e1103 write 0x30000 0x2 0x9fcc write 0x30002 0x1 0x01 write 0x30002 0x1 0x9f EOF ``` 3. Send second qtest command sequence (closing the connection at step 2 causes QEMU to flush the bottom-half handler) ```sh cat <<'EOF' | nc -N 127.0.0.1 44445 writeq 0xe0004df1 0xc1cb22d writeq 0xe0004df1 0xc1cb22d readl 0xe00053f4 readw 0xe0005004 writel 0xe0005440 0x2a0f9fd1 writeq 0xe0008807 0x6730c704 writew 0xe0004df1 0x5798 writel 0xe00070b0 0x3dfe1619 readb 0xe0005cdf writel 0xe0008807 0x6730c704 writeq 0xe0004df1 0xc1cb22d writel 0xe0008807 0x1000908 readq 0xe0008005 EOF ``` 4. Send `system_reset` through the monitor(qmp) socket and terminate ```sh cat <<'EOF' | nc -N 127.0.0.1 44446 system_reset quit EOF ``` Execution output: ```bash $ qemu-system-i386 --version ==2636158==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases! QEMU emulator version 11.0.0 (v11.0.0) Copyright (c) 2003-2026 Fabrice Bellard and the QEMU Project developers $ ./repro.sh ... ================================================================= ==2636159==ERROR: LeakSanitizer: detected memory leaks Direct leak of 2205 byte(s) in 63 object(s) allocated from: #0 0x76fd90afd340 in calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77 #1 0x76fd908b7771 in g_malloc0 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x63771) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3) #2 0x64115f20aed4 in address_space_map ../system/physmem.c:3752 #3 0x64115f01cde0 in dma_memory_map ../include/system/dma.h:212 #4 0x64115f02bc37 in virtqueue_map_desc ../hw/virtio/virtio.c:1637 #5 0x64115f02e043 in virtqueue_split_pop ../hw/virtio/virtio.c:1826 #6 0x64115f0327be in virtqueue_pop ../hw/virtio/virtio.c:2039 #7 0x64115f59e7da in virtio_gpu_handle_ctrl ../hw/display/virtio-gpu.c:1130 #8 0x64115f59e94e in virtio_gpu_ctrl_bh ../hw/display/virtio-gpu.c:1141 #9 0x64116031dbdc in aio_bh_call ../util/async.c:173 #10 0x64116031e419 in aio_bh_poll ../util/async.c:220 #11 0x6411602b1fe5 in aio_dispatch ../util/aio-posix.c:390 #12 0x64116031faf6 in aio_ctx_dispatch ../util/async.c:365 #13 0x76fd908b1584 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5d584) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3) #14 0x76fd908b16cf in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5d6cf) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3) #15 0x641160325982 in glib_pollfds_poll ../util/main-loop.c:290 #16 0x641160325b80 in os_host_main_loop_wait ../util/main-loop.c:313 #17 0x641160325eac in main_loop_wait ../util/main-loop.c:592 #18 0x64115f230245 in qemu_main_loop ../system/runstate.c:945 #19 0x64116007be90 in qemu_default_main ../system/main.c:50 #20 0x64116007bfe4 in main ../system/main.c:93 #21 0x76fd8e62a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #22 0x76fd8e62a28a in __libc_start_main_impl ../csu/libc-start.c:360 #23 0x64115e1d2d94 in _start (/home/juhyeongkim/workspace/qemu-latest/build-v11-asan/qemu-system-i386+0x30a6d94) (BuildId: fed9ed3f6424d105851cd2dd0df4c8c93d6c4dd5) Direct leak of 35 byte(s) in 1 object(s) allocated from: #0 0x76fd90afd340 in calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77 #1 0x76fd908b7771 in g_malloc0 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x63771) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3) #2 0x64115f20aed4 in address_space_map ../system/physmem.c:3752 #3 0x64115f01cde0 in dma_memory_map ../include/system/dma.h:212 #4 0x64115f02bc37 in virtqueue_map_desc ../hw/virtio/virtio.c:1637 #5 0x64115f02e043 in virtqueue_split_pop ../hw/virtio/virtio.c:1826 #6 0x64115f0327be in virtqueue_pop ../hw/virtio/virtio.c:2039 #7 0x64115f59e35c in virtio_gpu_handle_ctrl ../hw/display/virtio-gpu.c:1124 #8 0x64115f59e94e in virtio_gpu_ctrl_bh ../hw/display/virtio-gpu.c:1141 #9 0x64116031dbdc in aio_bh_call ../util/async.c:173 #10 0x64116031e419 in aio_bh_poll ../util/async.c:220 #11 0x6411602b1fe5 in aio_dispatch ../util/aio-posix.c:390 #12 0x64116031faf6 in aio_ctx_dispatch ../util/async.c:365 #13 0x76fd908b1584 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5d584) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3) #14 0x76fd908b16cf in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5d6cf) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3) #15 0x641160325982 in glib_pollfds_poll ../util/main-loop.c:290 #16 0x641160325b80 in os_host_main_loop_wait ../util/main-loop.c:313 #17 0x641160325eac in main_loop_wait ../util/main-loop.c:592 #18 0x64115f230245 in qemu_main_loop ../system/runstate.c:945 #19 0x64116007be90 in qemu_default_main ../system/main.c:50 #20 0x64116007bfe4 in main ../system/main.c:93 #21 0x76fd8e62a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #22 0x76fd8e62a28a in __libc_start_main_impl ../csu/libc-start.c:360 #23 0x64115e1d2d94 in _start (/home/juhyeongkim/workspace/qemu-latest/build-v11-asan/qemu-system-i386+0x30a6d94) (BuildId: fed9ed3f6424d105851cd2dd0df4c8c93d6c4dd5) SUMMARY: AddressSanitizer: 2240 byte(s) leaked in 64 allocation(s). ``` ## Additional information **Root cause:** `virtio_gpu_handle_ctrl` calls `virtqueue_pop`, which maps guest DMA regions via `virtqueue_map_desc` → `address_space_map` (allocating memory at `physmem.c:3752`). After a `system_reset`, in-flight ctrl commands are abandoned without calling `virtqueue_push` and without unmapping the DMA regions. The allocated bounce buffers are never freed. The fix is to drain and unmap all pending virtqueue elements before or during the reset path in `virtio_gpu_handle_ctrl` (or its caller).