In vfio_connect_container's error path, the base container is removed twice form the VFIOAddressSpace QLIST: first on the listener_release_exit label and second, on free_container_exit label, through object_unref(container), which calls vfio_container_instance_finalize().
Let's remove the first instance. Fixes: 938026053f4 ("vfio/container: Switch to QOM") Signed-off-by: Eric Auger <eric.au...@redhat.com> --- hw/vfio/container.c | 1 - 1 file changed, 1 deletion(-) diff --git a/hw/vfio/container.c b/hw/vfio/container.c index 425db1a14c..d8b7c533af 100644 --- a/hw/vfio/container.c +++ b/hw/vfio/container.c @@ -657,7 +657,6 @@ static bool vfio_connect_container(VFIOGroup *group, AddressSpace *as, return true; listener_release_exit: QLIST_REMOVE(group, container_next); - QLIST_REMOVE(bcontainer, next); vfio_kvm_device_del_group(group); memory_listener_unregister(&bcontainer->listener); if (vioc->release) { -- 2.41.0