Commit 724d78904f for qemu.org

commit 724d78904fee1251a82a0902b24668cf04775133
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
Date:   Thu Aug 27 18:55:08 2026 +0400

    virtio-gpu/virgl: free BHs and timers on renderer reset

    virtio_gpu_virgl_reset() does not free the bottom halves or timers
    allocated by the previous virtio_gpu_virgl_init() call. A subsequent
    virtio_gpu_virgl_init() overwrites the old pointers, leaking the
    previous allocations.

    Fixes: 7e688d1bf515 ("virtio-gpu: Handle virtio_gpu_virgl_init() failure")
    Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
    Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

diff --git a/hw/display/virtio-gpu-virgl.c b/hw/display/virtio-gpu-virgl.c
index 742d9dde4a..7f1d1e0c32 100644
--- a/hw/display/virtio-gpu-virgl.c
+++ b/hw/display/virtio-gpu-virgl.c
@@ -1430,6 +1430,7 @@ void virtio_gpu_virgl_reset_scanout(VirtIOGPU *g)

 static bool virtio_gpu_virgl_reset(VirtIOGPU *g)
 {
+    VirtIOGPUGL *gl = VIRTIO_GPU_GL(g);
     struct virtio_gpu_simple_resource *res, *tmp;

     /*
@@ -1448,6 +1449,11 @@ static bool virtio_gpu_virgl_reset(VirtIOGPU *g)

     virtio_gpu_virgl_reset_async_fences(g);

+    g_clear_pointer(&gl->cmdq_resume_bh, qemu_bh_delete);
+    g_clear_pointer(&gl->async_fence_bh, qemu_bh_delete);
+    g_clear_pointer(&gl->print_stats, timer_free);
+    g_clear_pointer(&gl->fence_poll, timer_free);
+
     return true;
 }