From: Eric Auger <eric.auger@redhat.com>
Date: Fri, 19 Jul 2024 16:50:11 +0000 (+0200)
Subject: hw/vfio/container: Fix SIGSEV on vfio_container_instance_finalize()
X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=07321a6d087d4ec9866cfb0c8b53692a59758976;p=qemu.git

hw/vfio/container: Fix SIGSEV on vfio_container_instance_finalize()

In vfio_connect_container's error path, the base container is
removed twice form the VFIOAddressSpace QLIST: first on the
listener_release_exit label and second, on free_container_exit
label, through object_unref(container), which calls
vfio_container_instance_finalize().

Let's remove the first instance.

Fixes: 938026053f4 ("vfio/container: Switch to QOM")
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
---

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 38a9df3496..ce9a858e56 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -656,7 +656,6 @@ static bool vfio_connect_container(VFIOGroup *group, AddressSpace *as,
     return true;
 listener_release_exit:
     QLIST_REMOVE(group, container_next);
-    QLIST_REMOVE(bcontainer, next);
     vfio_kvm_device_del_group(group);
     memory_listener_unregister(&bcontainer->listener);
     if (vioc->release) {