--- x/drivers/vhost/vhost.c
+++ y/drivers/vhost/vhost.c
@@ -692,6 +692,9 @@ void vhost_dev_cleanup(struct vhost_dev
 {
 	int i;
 
+	wake_up_interruptible_poll(&dev->wait, EPOLLIN | EPOLLRDNORM);
+	vhost_work_dev_flush(dev);
+
 	for (i = 0; i < dev->nvqs; ++i) {
 		if (dev->vqs[i]->error_ctx)
 			eventfd_ctx_put(dev->vqs[i]->error_ctx);
@@ -711,7 +714,6 @@ void vhost_dev_cleanup(struct vhost_dev
 	vhost_iotlb_free(dev->iotlb);
 	dev->iotlb = NULL;
 	vhost_clear_msg(dev);
-	wake_up_interruptible_poll(&dev->wait, EPOLLIN | EPOLLRDNORM);
 	WARN_ON(!llist_empty(&dev->work_list));
 	if (dev->worker) {
 		kthread_stop(dev->worker);