On failure, vhost_dev_init() clears vhost_dev, so the error path frees
NULL instead of the virtqueue array. Save the pointer locally and use
it to free the array on failure.
Fixes: 98fc1ada4cf7 ("virtio: add vhost-user-fs base device")
Signed-off-by: Alexandr Moshkov <[email protected]>
---
hw/virtio/vhost-user-fs.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/hw/virtio/vhost-user-fs.c b/hw/virtio/vhost-user-fs.c
index 0d8842817a..9b33fe13bb 100644
--- a/hw/virtio/vhost-user-fs.c
+++ b/hw/virtio/vhost-user-fs.c
@@ -198,6 +198,7 @@ static void vuf_device_realize(DeviceState *dev, Error
**errp)
{
VirtIODevice *vdev = VIRTIO_DEVICE(dev);
VHostUserFS *fs = VHOST_USER_FS(dev);
+ struct vhost_virtqueue *vhost_vqs;
unsigned int i;
size_t len;
int ret;
@@ -255,7 +256,8 @@ static void vuf_device_realize(DeviceState *dev, Error
**errp)
/* 1 high prio queue, plus the number configured */
fs->vhost_dev.nvqs = 1 + fs->conf.num_request_queues;
- fs->vhost_dev.vqs = g_new0(struct vhost_virtqueue, fs->vhost_dev.nvqs);
+ vhost_vqs = g_new0(struct vhost_virtqueue, fs->vhost_dev.nvqs);
+ fs->vhost_dev.vqs = vhost_vqs;
ret = vhost_dev_init(&fs->vhost_dev, &fs->vhost_user,
VHOST_BACKEND_TYPE_USER, 0, errp);
if (ret < 0) {
@@ -272,7 +274,7 @@ err_virtio:
}
g_free(fs->req_vqs);
virtio_cleanup(vdev);
- g_free(fs->vhost_dev.vqs);
+ g_free(vhost_vqs);
}
static void vuf_device_unrealize(DeviceState *dev)
--
2.34.1
