In case of NUMA reallocation, the virtqueue struct is reallocated on another socket, meaning that its address changes.
In translate_ring_addresses(), addr pointer was not fetched again after the reallocation, so it pointed to freed memory. This patch just fetch again addr pointer after the reallocation. Reported-by: Yao, Lei A <lei.a....@intel.com> Tested-by: Yao, Lei A <lei.a....@intel.com> Signed-off-by: Maxime Coquelin <maxime.coque...@redhat.com> --- lib/librte_vhost/vhost_user.c | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/librte_vhost/vhost_user.c b/lib/librte_vhost/vhost_user.c index 9acac6125..2416a0061 100644 --- a/lib/librte_vhost/vhost_user.c +++ b/lib/librte_vhost/vhost_user.c @@ -417,6 +417,7 @@ translate_ring_addresses(struct virtio_net *dev, int vq_index) dev = numa_realloc(dev, vq_index); vq = dev->virtqueue[vq_index]; + addr = &vq->ring_addrs; vq->avail = (struct vring_avail *)(uintptr_t)ring_addr_to_vva(dev, vq, addr->avail_user_addr, sizeof(struct vring_avail)); -- 2.13.6