When a gpu buffer backed by a guest-memory blob is unreferenced, virgl
and rutabaga free the resource but not its addrs field, leaking memory
on every unref.

In virtio-gpu-virgl.c, call virtio_gpu_cleanup_mapping() instead of
virtio_gpu_cleanup_mapping_iov(). In virtio-gpu-rutabaga.c, call
virtio_gpu_cleanup_mapping() before freeing the resource.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4634
Signed-off-by: Tom Desnoyers <tom.ds1@gmx.com>
---
v2:
- replace virtio_gpu_cleanup_mapping_iov() by virtio_gpu_cleanup_mapping() (Akihiko Odaki)

v1:
https://lore.kernel.org/qemu-devel/20261006135504.416083-1-tom.ds1@gmx.com

 hw/display/virtio-gpu-rutabaga.c | 2 ++
 hw/display/virtio-gpu-virgl.c    | 6 +++---
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/hw/display/virtio-gpu-rutabaga.c b/hw/display/virtio-gpu-rutabaga.c
index 3aafa4dc66..e5c993c758 100644
--- a/hw/display/virtio-gpu-rutabaga.c
+++ b/hw/display/virtio-gpu-rutabaga.c
@@ -164,6 +164,8 @@ virtio_gpu_rutabaga_resource_unref(VirtIOGPU *g,
     }
 
     QTAILQ_REMOVE(&g->reslist, res, next);
+
+    virtio_gpu_cleanup_mapping(g, res);
     g_free(res);
 }
 
diff --git a/hw/display/virtio-gpu-virgl.c b/hw/display/virtio-gpu-virgl.c
index f45571060f..f71f287d94 100644
--- a/hw/display/virtio-gpu-virgl.c
+++ b/hw/display/virtio-gpu-virgl.c
@@ -451,13 +451,13 @@ virtio_gpu_virgl_resource_unref(VirtIOGPU *g,
     virgl_renderer_resource_detach_iov(res->base.resource_id,
                                        &res_iovs,
                                        &num_iovs);
-    if (res_iovs != NULL && num_iovs != 0) {
-        virtio_gpu_cleanup_mapping_iov(g, res_iovs, num_iovs);
-    }
+    res->base.iov = res_iovs;
+    res->base.iov_cnt = num_iovs;
     virgl_renderer_resource_unref(res->base.resource_id);
 
     QTAILQ_REMOVE(&g->reslist, &res->base, next);
 
+    virtio_gpu_cleanup_mapping(g, &res->base);
     g_free(res);
 
     return 0;
-- 
2.56.0

On Mon, 12 Oct 2026 18:57:54 +0200, Tom Desnoyers <tom.ds1@gmx.com> wrote:
> When a gpu buffer backed by a guest-memory blob is unreferenced, virgl
> and rutabaga free the resource but not its addrs field, leaking memory
> on every unref.
> 
> In virtio-gpu-virgl.c, call virtio_gpu_cleanup_mapping() instead of
> virtio_gpu_cleanup_mapping_iov(). In virtio-gpu-rutabaga.c, call
> virtio_gpu_cleanup_mapping() before freeing the resource.
> 
> [...]

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>

-- 
Marc-André Lureau <marcandre.lureau@redhat.com>