From 07321a6d087d4ec9866cfb0c8b53692a59758976 Mon Sep 17 00:00:00 2001 From: Eric Auger Date: Fri, 19 Jul 2024 18:50:11 +0200 Subject: [PATCH] hw/vfio/container: Fix SIGSEV on vfio_container_instance_finalize() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In vfio_connect_container's error path, the base container is removed twice form the VFIOAddressSpace QLIST: first on the listener_release_exit label and second, on free_container_exit label, through object_unref(container), which calls vfio_container_instance_finalize(). Let's remove the first instance. Fixes: 938026053f4 ("vfio/container: Switch to QOM") Signed-off-by: Eric Auger Reviewed-by: Cédric Le Goater Reviewed-by: Zhenzhong Duan --- hw/vfio/container.c | 1 - 1 file changed, 1 deletion(-) diff --git a/hw/vfio/container.c b/hw/vfio/container.c index 38a9df3496..ce9a858e56 100644 --- a/hw/vfio/container.c +++ b/hw/vfio/container.c @@ -656,7 +656,6 @@ static bool vfio_connect_container(VFIOGroup *group, AddressSpace *as, return true; listener_release_exit: QLIST_REMOVE(group, container_next); - QLIST_REMOVE(bcontainer, next); vfio_kvm_device_del_group(group); memory_listener_unregister(&bcontainer->listener); if (vioc->release) {