On Thu, 5 Nov 2026 at 15:29, Stefano Garzarella <[email protected]>
wrote:
>
> On Wed, Nov 04, 2026 at 01:09:39PM +0500, Alexandr Moshkov wrote:
> >On failure, vhost_dev_init() clears vhost_dev, so the error path frees
> >NULL instead of the virtqueue array. Save the pointer locally and use
> >it to free the array on failure.
> >
> >Fixes: 98fc1ada4cf7 ("virtio: add vhost-user-fs base device")
> >Signed-off-by: Alexandr Moshkov <[email protected]>
> >---
> > hw/virtio/vhost-user-fs.c | 6 ++++--
> > 1 file changed, 4 insertions(+), 2 deletions(-)
> >
> >diff --git a/hw/virtio/vhost-user-fs.c b/hw/virtio/vhost-user-fs.c
> >index 0d8842817a..9b33fe13bb 100644
> >--- a/hw/virtio/vhost-user-fs.c
> >+++ b/hw/virtio/vhost-user-fs.c
> >@@ -198,6 +198,7 @@ static void vuf_device_realize(DeviceState *dev, Error
> >**errp)
> > {
> > VirtIODevice *vdev = VIRTIO_DEVICE(dev);
> > VHostUserFS *fs = VHOST_USER_FS(dev);
> >+ struct vhost_virtqueue *vhost_vqs;
> > unsigned int i;
> > size_t len;
> > int ret;
> >@@ -255,7 +256,8 @@ static void vuf_device_realize(DeviceState *dev, Error
> >**errp)
> >
> > /* 1 high prio queue, plus the number configured */
> > fs->vhost_dev.nvqs = 1 + fs->conf.num_request_queues;
> >- fs->vhost_dev.vqs = g_new0(struct vhost_virtqueue, fs->vhost_dev.nvqs);
> >+ vhost_vqs = g_new0(struct vhost_virtqueue, fs->vhost_dev.nvqs);
>
> While checking if others users of vhost_dev_init() have the same issues,
FYI backends/vhost-user.c has the same issue. I'll send a patch to fix
it.
Thanks,
Stefano
> I discovered that most of them store it in the parent structure (the
> equivalent of VHostUserFS). Then looking at VHostUserFS I discovered
> that we already have the vhost_vqs field there since the beginning, but
> we never used it, so what about using that one here and in
> vuf_device_unrealize() ?
>
> Thanks,
> Stefano
>
> >+ fs->vhost_dev.vqs = vhost_vqs;
> > ret = vhost_dev_init(&fs->vhost_dev, &fs->vhost_user,
> > VHOST_BACKEND_TYPE_USER, 0, errp);
> > if (ret < 0) {
> >@@ -272,7 +274,7 @@ err_virtio:
> > }
> > g_free(fs->req_vqs);
> > virtio_cleanup(vdev);
> >- g_free(fs->vhost_dev.vqs);
> >+ g_free(vhost_vqs);
> > }
> >
> > static void vuf_device_unrealize(DeviceState *dev)
> >--
> >2.34.1
> >
