From: GuoHan Zhao <[email protected]> vhost-user-base stores the VirtQueue pointers in a GPtrArray, but its cleanup helper only deletes the VirtQueues and leaves the array itself allocated.
Free the GPtrArray after deleting the queues and clear the pointer so cleanup remains safe if the error path reaches it with no queues to release. Fixes: 6275989647ef (virtio: split into vhost-user-base and vhost-user-device) Signed-off-by: GuoHan Zhao <[email protected]> Reviewed-by: Michael S. Tsirkin <[email protected]> Signed-off-by: Michael S. Tsirkin <[email protected]> Message-ID: <[email protected]> --- hw/virtio/vhost-user-base.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/hw/virtio/vhost-user-base.c b/hw/virtio/vhost-user-base.c index 39b5e637fc..6ac523f9eb 100644 --- a/hw/virtio/vhost-user-base.c +++ b/hw/virtio/vhost-user-base.c @@ -193,9 +193,13 @@ static void do_vhost_user_cleanup(VirtIODevice *vdev, VHostUserBase *vub) { vhost_user_cleanup(&vub->vhost_user); - for (int i = 0; i < vub->num_vqs; i++) { - VirtQueue *vq = g_ptr_array_index(vub->vqs, i); - virtio_delete_queue(vq); + if (vub->vqs) { + for (int i = 0; i < vub->num_vqs; i++) { + VirtQueue *vq = g_ptr_array_index(vub->vqs, i); + virtio_delete_queue(vq); + } + g_ptr_array_free(vub->vqs, true); + vub->vqs = NULL; } virtio_cleanup(vdev); -- MST
