Commit 5ce01c9238 for qemu.org

commit 5ce01c92389a422389898df481ed441a80ece3c4
Author: Bin Guo <guobin@linux.alibaba.com>
Date:   Mon Aug 3 16:21:58 2026 +0800

    hw/display/virtio-gpu: Unmap DMA regions on reset

    virtio_gpu_reset() freed in-flight commands without unmapping the
    DMA regions acquired by virtqueue_pop().  Call virtqueue_detach_element()
    before g_free() in both drain loops.

    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3467
    Cc: qemu-stable@nongnu.org
    Signed-off-by: Bin Guo <guobin@linux.alibaba.com>
    Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
    Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Message-ID: <20260803082158.62998-1-guobin@linux.alibaba.com>

diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index c15d4b527d..fbb6fec7a0 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -1725,12 +1725,14 @@ void virtio_gpu_reset(VirtIODevice *vdev)
     while (!QTAILQ_EMPTY(&g->cmdq)) {
         cmd = QTAILQ_FIRST(&g->cmdq);
         QTAILQ_REMOVE(&g->cmdq, cmd, next);
+        virtqueue_detach_element(cmd->vq, &cmd->elem, 0);
         g_free(cmd);
     }

     while (!QTAILQ_EMPTY(&g->fenceq)) {
         cmd = QTAILQ_FIRST(&g->fenceq);
         QTAILQ_REMOVE(&g->fenceq, cmd, next);
+        virtqueue_detach_element(cmd->vq, &cmd->elem, 0);
         g->inflight--;
         g_free(cmd);
     }