On Tue, 11/24 19:00, Paolo Bonzini wrote: > @@ -436,10 +454,11 @@ static void control_out(VirtIODevice *vdev, VirtQueue > *vq) > buf = g_malloc(cur_len); > len = cur_len; > } > - iov_to_buf(elem.out_sg, elem.out_num, 0, buf, cur_len); > + iov_to_buf(elem->out_sg, elem->out_num, 0, buf, cur_len); > > handle_control_message(vser, buf, cur_len); > - virtqueue_push(vq, &elem, 0); > + virtqueue_push(vq, elem, 0); > + g_free(elem);
s/^\t/ / ?