4 files changed, 124 insertions, 87 deletions

diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 87c216c1e54e..176aa030dc5f 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -64,9 +64,13 @@ enum {
         VHOST_NET_VQ_MAX = 2,
 };
 
+struct vhost_net_virtqueue {
+        struct vhost_virtqueue vq;
+};
+
 struct vhost_net {
         struct vhost_dev dev;
-        struct vhost_virtqueue vqs[VHOST_NET_VQ_MAX];
+        struct vhost_net_virtqueue vqs[VHOST_NET_VQ_MAX];
         struct vhost_poll poll[VHOST_NET_VQ_MAX];
         /* Number of TX recently submitted.
          * Protected by tx vq lock. */
@@ -198,7 +202,7 @@ static void vhost_zerocopy_callback(struct ubuf_info *ubuf, bool success)
  * read-size critical section for our kind of RCU. */
 static void handle_tx(struct vhost_net *net)
 {
-        struct vhost_virtqueue *vq = &net->dev.vqs[VHOST_NET_VQ_TX];
+        struct vhost_virtqueue *vq = &net->vqs[VHOST_NET_VQ_TX].vq;
         unsigned out, in, s;
         int head;
         struct msghdr msg = {
@@ -417,7 +421,7 @@ err:
  * read-size critical section for our kind of RCU. */
 static void handle_rx(struct vhost_net *net)
 {
-        struct vhost_virtqueue *vq = &net->dev.vqs[VHOST_NET_VQ_RX];
+        struct vhost_virtqueue *vq = &net->vqs[VHOST_NET_VQ_RX].vq;
         unsigned uninitialized_var(in), log;
         struct vhost_log *vq_log;
         struct msghdr msg = {
@@ -559,17 +563,26 @@ static int vhost_net_open(struct inode *inode, struct file *f)
 {
         struct vhost_net *n = kmalloc(sizeof *n, GFP_KERNEL);
         struct vhost_dev *dev;
+        struct vhost_virtqueue **vqs;
         int r;
 
         if (!n)
                 return -ENOMEM;
+        vqs = kmalloc(VHOST_NET_VQ_MAX * sizeof(*vqs), GFP_KERNEL);
+        if (!vqs) {
+                kfree(n);
+                return -ENOMEM;
+        }
 
         dev = &n->dev;
-        n->vqs[VHOST_NET_VQ_TX].handle_kick = handle_tx_kick;
-        n->vqs[VHOST_NET_VQ_RX].handle_kick = handle_rx_kick;
-        r = vhost_dev_init(dev, n->vqs, VHOST_NET_VQ_MAX);
+        vqs[VHOST_NET_VQ_TX] = &n->vqs[VHOST_NET_VQ_TX].vq;
+        vqs[VHOST_NET_VQ_RX] = &n->vqs[VHOST_NET_VQ_RX].vq;
+        n->vqs[VHOST_NET_VQ_TX].vq.handle_kick = handle_tx_kick;
+        n->vqs[VHOST_NET_VQ_RX].vq.handle_kick = handle_rx_kick;
+        r = vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX);
         if (r < 0) {
                 kfree(n);
+                kfree(vqs);
                 return r;
         }
 
@@ -584,7 +597,9 @@ static int vhost_net_open(struct inode *inode, struct file *f)
 static void vhost_net_disable_vq(struct vhost_net *n,
                                  struct vhost_virtqueue *vq)
 {
-        struct vhost_poll *poll = n->poll + (vq - n->vqs);
+        struct vhost_net_virtqueue *nvq =
+                container_of(vq, struct vhost_net_virtqueue, vq);
+        struct vhost_poll *poll = n->poll + (nvq - n->vqs);
         if (!vq->private_data)
                 return;
         vhost_poll_stop(poll);
@@ -593,7 +608,9 @@ static void vhost_net_disable_vq(struct vhost_net *n,
 static int vhost_net_enable_vq(struct vhost_net *n,
                                 struct vhost_virtqueue *vq)
 {
-        struct vhost_poll *poll = n->poll + (vq - n->vqs);
+        struct vhost_net_virtqueue *nvq =
+                container_of(vq, struct vhost_net_virtqueue, vq);
+        struct vhost_poll *poll = n->poll + (nvq - n->vqs);
         struct socket *sock;
 
         sock = rcu_dereference_protected(vq->private_data,
@@ -621,30 +638,30 @@ static struct socket *vhost_net_stop_vq(struct vhost_net *n,
 static void vhost_net_stop(struct vhost_net *n, struct socket **tx_sock,
                            struct socket **rx_sock)
 {
-        *tx_sock = vhost_net_stop_vq(n, n->vqs + VHOST_NET_VQ_TX);
-        *rx_sock = vhost_net_stop_vq(n, n->vqs + VHOST_NET_VQ_RX);
+        *tx_sock = vhost_net_stop_vq(n, &n->vqs[VHOST_NET_VQ_TX].vq);
+        *rx_sock = vhost_net_stop_vq(n, &n->vqs[VHOST_NET_VQ_RX].vq);
 }
 
 static void vhost_net_flush_vq(struct vhost_net *n, int index)
 {
         vhost_poll_flush(n->poll + index);
-        vhost_poll_flush(&n->dev.vqs[index].poll);
+        vhost_poll_flush(&n->vqs[index].vq.poll);
 }
 
 static void vhost_net_flush(struct vhost_net *n)
 {
         vhost_net_flush_vq(n, VHOST_NET_VQ_TX);
         vhost_net_flush_vq(n, VHOST_NET_VQ_RX);
-        if (n->dev.vqs[VHOST_NET_VQ_TX].ubufs) {
-                mutex_lock(&n->dev.vqs[VHOST_NET_VQ_TX].mutex);
+        if (n->vqs[VHOST_NET_VQ_TX].vq.ubufs) {
+                mutex_lock(&n->vqs[VHOST_NET_VQ_TX].vq.mutex);
                 n->tx_flush = true;
-                mutex_unlock(&n->dev.vqs[VHOST_NET_VQ_TX].mutex);
+                mutex_unlock(&n->vqs[VHOST_NET_VQ_TX].vq.mutex);
                 /* Wait for all lower device DMAs done. */
-                vhost_ubuf_put_and_wait(n->dev.vqs[VHOST_NET_VQ_TX].ubufs);
-                mutex_lock(&n->dev.vqs[VHOST_NET_VQ_TX].mutex);
+                vhost_ubuf_put_and_wait(n->vqs[VHOST_NET_VQ_TX].vq.ubufs);
+                mutex_lock(&n->vqs[VHOST_NET_VQ_TX].vq.mutex);
                 n->tx_flush = false;
-                kref_init(&n->dev.vqs[VHOST_NET_VQ_TX].ubufs->kref);
-                mutex_unlock(&n->dev.vqs[VHOST_NET_VQ_TX].mutex);
+                kref_init(&n->vqs[VHOST_NET_VQ_TX].vq.ubufs->kref);
+                mutex_unlock(&n->vqs[VHOST_NET_VQ_TX].vq.mutex);
         }
 }
 
@@ -665,6 +682,7 @@ static int vhost_net_release(struct inode *inode, struct file *f)
         /* We do an extra flush before freeing memory,
          * since jobs can re-queue themselves. */
         vhost_net_flush(n);
+        kfree(n->dev.vqs);
         kfree(n);
         return 0;
 }
@@ -750,7 +768,7 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
                 r = -ENOBUFS;
                 goto err;
         }
-        vq = n->vqs + index;
+        vq = &n->vqs[index].vq;
         mutex_lock(&vq->mutex);
 
         /* Verify that ring has been setup correctly. */
@@ -870,10 +888,10 @@ static int vhost_net_set_features(struct vhost_net *n, u64 features)
         n->dev.acked_features = features;
         smp_wmb();
         for (i = 0; i < VHOST_NET_VQ_MAX; ++i) {
-                mutex_lock(&n->vqs[i].mutex);
-                n->vqs[i].vhost_hlen = vhost_hlen;
-                n->vqs[i].sock_hlen = sock_hlen;
-                mutex_unlock(&n->vqs[i].mutex);
+                mutex_lock(&n->vqs[i].vq.mutex);
+                n->vqs[i].vq.vhost_hlen = vhost_hlen;
+                n->vqs[i].vq.sock_hlen = sock_hlen;
+                mutex_unlock(&n->vqs[i].vq.mutex);
         }
         vhost_net_flush(n);
         mutex_unlock(&n->dev.mutex);
diff --git a/drivers/vhost/tcm_vhost.c b/drivers/vhost/tcm_vhost.c
index 1677238d281f..99d3480450e7 100644
--- a/drivers/vhost/tcm_vhost.c
+++ b/drivers/vhost/tcm_vhost.c
@@ -74,13 +74,17 @@ enum {
 #define VHOST_SCSI_MAX_VQ       128
 #define VHOST_SCSI_MAX_EVENT    128
 
+struct vhost_scsi_virtqueue {
+        struct vhost_virtqueue vq;
+};
+
 struct vhost_scsi {
         /* Protected by vhost_scsi->dev.mutex */
         struct tcm_vhost_tpg **vs_tpg;
         char vs_vhost_wwpn[TRANSPORT_IQN_LEN];
 
         struct vhost_dev dev;
-        struct vhost_virtqueue vqs[VHOST_SCSI_MAX_VQ];
+        struct vhost_scsi_virtqueue vqs[VHOST_SCSI_MAX_VQ];
 
         struct vhost_work vs_completion_work; /* cmd completion work item */
         struct llist_head vs_completion_list; /* cmd completion queue */
@@ -366,7 +370,7 @@ static void tcm_vhost_free_evt(struct vhost_scsi *vs, struct tcm_vhost_evt *evt)
 static struct tcm_vhost_evt *tcm_vhost_allocate_evt(struct vhost_scsi *vs,
         u32 event, u32 reason)
 {
-        struct vhost_virtqueue *vq = &vs->vqs[VHOST_SCSI_VQ_EVT];
+        struct vhost_virtqueue *vq = &vs->vqs[VHOST_SCSI_VQ_EVT].vq;
         struct tcm_vhost_evt *evt;
 
         if (vs->vs_events_nr > VHOST_SCSI_MAX_EVENT) {
@@ -409,7 +413,7 @@ static void vhost_scsi_free_cmd(struct tcm_vhost_cmd *tv_cmd)
 static void tcm_vhost_do_evt_work(struct vhost_scsi *vs,
         struct tcm_vhost_evt *evt)
 {
-        struct vhost_virtqueue *vq = &vs->vqs[VHOST_SCSI_VQ_EVT];
+        struct vhost_virtqueue *vq = &vs->vqs[VHOST_SCSI_VQ_EVT].vq;
         struct virtio_scsi_event *event = &evt->event;
         struct virtio_scsi_event __user *eventp;
         unsigned out, in;
@@ -460,7 +464,7 @@ static void tcm_vhost_evt_work(struct vhost_work *work)
 {
         struct vhost_scsi *vs = container_of(work, struct vhost_scsi,
                                         vs_event_work);
-        struct vhost_virtqueue *vq = &vs->vqs[VHOST_SCSI_VQ_EVT];
+        struct vhost_virtqueue *vq = &vs->vqs[VHOST_SCSI_VQ_EVT].vq;
         struct tcm_vhost_evt *evt;
         struct llist_node *llnode;
 
@@ -511,8 +515,10 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work)
                        v_rsp.sense_len);
                 ret = copy_to_user(tv_cmd->tvc_resp, &v_rsp, sizeof(v_rsp));
                 if (likely(ret == 0)) {
+                        struct vhost_scsi_virtqueue *q;
                         vhost_add_used(tv_cmd->tvc_vq, tv_cmd->tvc_vq_desc, 0);
-                        vq = tv_cmd->tvc_vq - vs->vqs;
+                        q = container_of(tv_cmd->tvc_vq, struct vhost_scsi_virtqueue, vq);
+                        vq = q - vs->vqs;
                         __set_bit(vq, signal);
                 } else
                         pr_err("Faulted on virtio_scsi_cmd_resp\n");
@@ -523,7 +529,7 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work)
         vq = -1;
         while ((vq = find_next_bit(signal, VHOST_SCSI_MAX_VQ, vq + 1))
                 < VHOST_SCSI_MAX_VQ)
-                vhost_signal(&vs->dev, &vs->vqs[vq]);
+                vhost_signal(&vs->dev, &vs->vqs[vq].vq);
 }
 
 static struct tcm_vhost_cmd *vhost_scsi_allocate_cmd(
@@ -938,7 +944,7 @@ static void vhost_scsi_handle_kick(struct vhost_work *work)
 
 static void vhost_scsi_flush_vq(struct vhost_scsi *vs, int index)
 {
-        vhost_poll_flush(&vs->dev.vqs[index].poll);
+        vhost_poll_flush(&vs->vqs[index].vq.poll);
 }
 
 static void vhost_scsi_flush(struct vhost_scsi *vs)
@@ -975,7 +981,7 @@ static int vhost_scsi_set_endpoint(
         /* Verify that ring has been setup correctly. */
         for (index = 0; index < vs->dev.nvqs; ++index) {
                 /* Verify that ring has been setup correctly. */
-                if (!vhost_vq_access_ok(&vs->vqs[index])) {
+                if (!vhost_vq_access_ok(&vs->vqs[index].vq)) {
                         ret = -EFAULT;
                         goto out;
                 }
@@ -1022,7 +1028,7 @@ static int vhost_scsi_set_endpoint(
                 memcpy(vs->vs_vhost_wwpn, t->vhost_wwpn,
                        sizeof(vs->vs_vhost_wwpn));
                 for (i = 0; i < VHOST_SCSI_MAX_VQ; i++) {
-                        vq = &vs->vqs[i];
+                        vq = &vs->vqs[i].vq;
                         /* Flushing the vhost_work acts as synchronize_rcu */
                         mutex_lock(&vq->mutex);
                         rcu_assign_pointer(vq->private_data, vs_tpg);
@@ -1063,7 +1069,7 @@ static int vhost_scsi_clear_endpoint(
         mutex_lock(&vs->dev.mutex);
         /* Verify that ring has been setup correctly. */
         for (index = 0; index < vs->dev.nvqs; ++index) {
-                if (!vhost_vq_access_ok(&vs->vqs[index])) {
+                if (!vhost_vq_access_ok(&vs->vqs[index].vq)) {
                         ret = -EFAULT;
                         goto err_dev;
                 }
@@ -1103,7 +1109,7 @@ static int vhost_scsi_clear_endpoint(
         }
         if (match) {
                 for (i = 0; i < VHOST_SCSI_MAX_VQ; i++) {
-                        vq = &vs->vqs[i];
+                        vq = &vs->vqs[i].vq;
                         /* Flushing the vhost_work acts as synchronize_rcu */
                         mutex_lock(&vq->mutex);
                         rcu_assign_pointer(vq->private_data, NULL);
@@ -1151,24 +1157,36 @@ static int vhost_scsi_set_features(struct vhost_scsi *vs, u64 features)
 static int vhost_scsi_open(struct inode *inode, struct file *f)
 {
         struct vhost_scsi *s;
+        struct vhost_virtqueue **vqs;
         int r, i;
 
         s = kzalloc(sizeof(*s), GFP_KERNEL);
         if (!s)
                 return -ENOMEM;
 
+        vqs = kmalloc(VHOST_SCSI_MAX_VQ * sizeof(*vqs), GFP_KERNEL);
+        if (!vqs) {
+                kfree(s);
+                return -ENOMEM;
+        }
+
         vhost_work_init(&s->vs_completion_work, vhost_scsi_complete_cmd_work);
         vhost_work_init(&s->vs_event_work, tcm_vhost_evt_work);
 
         s->vs_events_nr = 0;
         s->vs_events_missed = false;
 
-        s->vqs[VHOST_SCSI_VQ_CTL].handle_kick = vhost_scsi_ctl_handle_kick;
-        s->vqs[VHOST_SCSI_VQ_EVT].handle_kick = vhost_scsi_evt_handle_kick;
-        for (i = VHOST_SCSI_VQ_IO; i < VHOST_SCSI_MAX_VQ; i++)
-                s->vqs[i].handle_kick = vhost_scsi_handle_kick;
-        r = vhost_dev_init(&s->dev, s->vqs, VHOST_SCSI_MAX_VQ);
+        vqs[VHOST_SCSI_VQ_CTL] = &s->vqs[VHOST_SCSI_VQ_CTL].vq;
+        vqs[VHOST_SCSI_VQ_EVT] = &s->vqs[VHOST_SCSI_VQ_EVT].vq;
+        s->vqs[VHOST_SCSI_VQ_CTL].vq.handle_kick = vhost_scsi_ctl_handle_kick;
+        s->vqs[VHOST_SCSI_VQ_EVT].vq.handle_kick = vhost_scsi_evt_handle_kick;
+        for (i = VHOST_SCSI_VQ_IO; i < VHOST_SCSI_MAX_VQ; i++) {
+                vqs[i] = &s->vqs[i].vq;
+                s->vqs[i].vq.handle_kick = vhost_scsi_handle_kick;
+        }
+        r = vhost_dev_init(&s->dev, vqs, VHOST_SCSI_MAX_VQ);
         if (r < 0) {
+                kfree(vqs);
                 kfree(s);
                 return r;
         }
@@ -1190,6 +1208,7 @@ static int vhost_scsi_release(struct inode *inode, struct file *f)
         vhost_dev_cleanup(&s->dev, false);
         /* Jobs can re-queue themselves in evt kick handler. Do extra flush. */
         vhost_scsi_flush(s);
+        kfree(s->dev.vqs);
         kfree(s);
         return 0;
 }
@@ -1205,7 +1224,7 @@ static long vhost_scsi_ioctl(struct file *f, unsigned int ioctl,
         u32 events_missed;
         u64 features;
         int r, abi_version = VHOST_SCSI_ABI_VERSION;
-        struct vhost_virtqueue *vq = &vs->vqs[VHOST_SCSI_VQ_EVT];
+        struct vhost_virtqueue *vq = &vs->vqs[VHOST_SCSI_VQ_EVT].vq;
 
         switch (ioctl) {
         case VHOST_SCSI_SET_ENDPOINT:
@@ -1333,7 +1352,7 @@ static void tcm_vhost_do_plug(struct tcm_vhost_tpg *tpg,
         else
                 reason = VIRTIO_SCSI_EVT_RESET_REMOVED;
 
-        vq = &vs->vqs[VHOST_SCSI_VQ_EVT];
+        vq = &vs->vqs[VHOST_SCSI_VQ_EVT].vq;
         mutex_lock(&vq->mutex);
         tcm_vhost_send_evt(vs, tpg, lun,
                         VIRTIO_SCSI_T_TRANSPORT_RESET, reason);
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 4eecdb867d53..bef8b6bae186 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -269,27 +269,27 @@ static long vhost_dev_alloc_iovecs(struct vhost_dev *dev)
         bool zcopy;
 
         for (i = 0; i < dev->nvqs; ++i) {
-                dev->vqs[i].indirect = kmalloc(sizeof *dev->vqs[i].indirect *
+                dev->vqs[i]->indirect = kmalloc(sizeof *dev->vqs[i]->indirect *
                                                UIO_MAXIOV, GFP_KERNEL);
-                dev->vqs[i].log = kmalloc(sizeof *dev->vqs[i].log * UIO_MAXIOV,
+                dev->vqs[i]->log = kmalloc(sizeof *dev->vqs[i]->log * UIO_MAXIOV,
                                           GFP_KERNEL);
-                dev->vqs[i].heads = kmalloc(sizeof *dev->vqs[i].heads *
+                dev->vqs[i]->heads = kmalloc(sizeof *dev->vqs[i]->heads *
                                             UIO_MAXIOV, GFP_KERNEL);
                 zcopy = vhost_zcopy_mask & (0x1 << i);
                 if (zcopy)
-                        dev->vqs[i].ubuf_info =
-                                kmalloc(sizeof *dev->vqs[i].ubuf_info *
+                        dev->vqs[i]->ubuf_info =
+                                kmalloc(sizeof *dev->vqs[i]->ubuf_info *
                                         UIO_MAXIOV, GFP_KERNEL);
-                if (!dev->vqs[i].indirect || !dev->vqs[i].log ||
-                        !dev->vqs[i].heads ||
-                        (zcopy && !dev->vqs[i].ubuf_info))
+                if (!dev->vqs[i]->indirect || !dev->vqs[i]->log ||
+                        !dev->vqs[i]->heads ||
+                        (zcopy && !dev->vqs[i]->ubuf_info))
                         goto err_nomem;
         }
         return 0;
 
 err_nomem:
         for (; i >= 0; --i)
-                vhost_vq_free_iovecs(&dev->vqs[i]);
+                vhost_vq_free_iovecs(dev->vqs[i]);
         return -ENOMEM;
 }
 
@@ -298,11 +298,11 @@ static void vhost_dev_free_iovecs(struct vhost_dev *dev)
         int i;
 
         for (i = 0; i < dev->nvqs; ++i)
-                vhost_vq_free_iovecs(&dev->vqs[i]);
+                vhost_vq_free_iovecs(dev->vqs[i]);
 }
 
 long vhost_dev_init(struct vhost_dev *dev,
-                    struct vhost_virtqueue *vqs, int nvqs)
+                    struct vhost_virtqueue **vqs, int nvqs)
 {
         int i;
 
@@ -318,16 +318,16 @@ long vhost_dev_init(struct vhost_dev *dev,
         dev->worker = NULL;
 
         for (i = 0; i < dev->nvqs; ++i) {
-                dev->vqs[i].log = NULL;
-                dev->vqs[i].indirect = NULL;
-                dev->vqs[i].heads = NULL;
-                dev->vqs[i].ubuf_info = NULL;
-                dev->vqs[i].dev = dev;
-                mutex_init(&dev->vqs[i].mutex);
-                vhost_vq_reset(dev, dev->vqs + i);
-                if (dev->vqs[i].handle_kick)
-                        vhost_poll_init(&dev->vqs[i].poll,
-                                        dev->vqs[i].handle_kick, POLLIN, dev);
+                dev->vqs[i]->log = NULL;
+                dev->vqs[i]->indirect = NULL;
+                dev->vqs[i]->heads = NULL;
+                dev->vqs[i]->ubuf_info = NULL;
+                dev->vqs[i]->dev = dev;
+                mutex_init(&dev->vqs[i]->mutex);
+                vhost_vq_reset(dev, dev->vqs[i]);
+                if (dev->vqs[i]->handle_kick)
+                        vhost_poll_init(&dev->vqs[i]->poll,
+                                        dev->vqs[i]->handle_kick, POLLIN, dev);
         }
 
         return 0;
@@ -430,9 +430,9 @@ void vhost_dev_stop(struct vhost_dev *dev)
         int i;
 
         for (i = 0; i < dev->nvqs; ++i) {
-                if (dev->vqs[i].kick && dev->vqs[i].handle_kick) {
-                        vhost_poll_stop(&dev->vqs[i].poll);
-                        vhost_poll_flush(&dev->vqs[i].poll);
+                if (dev->vqs[i]->kick && dev->vqs[i]->handle_kick) {
+                        vhost_poll_stop(&dev->vqs[i]->poll);
+                        vhost_poll_flush(&dev->vqs[i]->poll);
                 }
         }
 }
@@ -443,17 +443,17 @@ void vhost_dev_cleanup(struct vhost_dev *dev, bool locked)
         int i;
 
         for (i = 0; i < dev->nvqs; ++i) {
-                if (dev->vqs[i].error_ctx)
-                        eventfd_ctx_put(dev->vqs[i].error_ctx);
-                if (dev->vqs[i].error)
-                        fput(dev->vqs[i].error);
-                if (dev->vqs[i].kick)
-                        fput(dev->vqs[i].kick);
-                if (dev->vqs[i].call_ctx)
-                        eventfd_ctx_put(dev->vqs[i].call_ctx);
-                if (dev->vqs[i].call)
-                        fput(dev->vqs[i].call);
-                vhost_vq_reset(dev, dev->vqs + i);
+                if (dev->vqs[i]->error_ctx)
+                        eventfd_ctx_put(dev->vqs[i]->error_ctx);
+                if (dev->vqs[i]->error)
+                        fput(dev->vqs[i]->error);
+                if (dev->vqs[i]->kick)
+                        fput(dev->vqs[i]->kick);
+                if (dev->vqs[i]->call_ctx)
+                        eventfd_ctx_put(dev->vqs[i]->call_ctx);
+                if (dev->vqs[i]->call)
+                        fput(dev->vqs[i]->call);
+                vhost_vq_reset(dev, dev->vqs[i]);
         }
         vhost_dev_free_iovecs(dev);
         if (dev->log_ctx)
@@ -524,14 +524,14 @@ static int memory_access_ok(struct vhost_dev *d, struct vhost_memory *mem,
 
         for (i = 0; i < d->nvqs; ++i) {
                 int ok;
-                mutex_lock(&d->vqs[i].mutex);
+                mutex_lock(&d->vqs[i]->mutex);
                 /* If ring is inactive, will check when it's enabled. */
-                if (d->vqs[i].private_data)
-                        ok = vq_memory_access_ok(d->vqs[i].log_base, mem,
+                if (d->vqs[i]->private_data)
+                        ok = vq_memory_access_ok(d->vqs[i]->log_base, mem,
                                                  log_all);
                 else
                         ok = 1;
-                mutex_unlock(&d->vqs[i].mutex);
+                mutex_unlock(&d->vqs[i]->mutex);
                 if (!ok)
                         return 0;
         }
@@ -641,7 +641,7 @@ long vhost_vring_ioctl(struct vhost_dev *d, int ioctl, void __user *argp)
         if (idx >= d->nvqs)
                 return -ENOBUFS;
 
-        vq = d->vqs + idx;
+        vq = d->vqs[idx];
 
         mutex_lock(&vq->mutex);
 
@@ -852,7 +852,7 @@ long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
                 for (i = 0; i < d->nvqs; ++i) {
                         struct vhost_virtqueue *vq;
                         void __user *base = (void __user *)(unsigned long)p;
-                        vq = d->vqs + i;
+                        vq = d->vqs[i];
                         mutex_lock(&vq->mutex);
                         /* If ring is inactive, will check when it's enabled. */
                         if (vq->private_data && !vq_log_access_ok(d, vq, base))
@@ -879,9 +879,9 @@ long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
                 } else
                         filep = eventfp;
                 for (i = 0; i < d->nvqs; ++i) {
-                        mutex_lock(&d->vqs[i].mutex);
-                        d->vqs[i].log_ctx = d->log_ctx;
-                        mutex_unlock(&d->vqs[i].mutex);
+                        mutex_lock(&d->vqs[i]->mutex);
+                        d->vqs[i]->log_ctx = d->log_ctx;
+                        mutex_unlock(&d->vqs[i]->mutex);
                 }
                 if (ctx)
                         eventfd_ctx_put(ctx);
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index 17261e277c02..f3afa8a41fe0 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -150,7 +150,7 @@ struct vhost_dev {
         struct mm_struct *mm;
         struct mutex mutex;
         unsigned acked_features;
-        struct vhost_virtqueue *vqs;
+        struct vhost_virtqueue **vqs;
         int nvqs;
         struct file *log_file;
         struct eventfd_ctx *log_ctx;
@@ -159,7 +159,7 @@ struct vhost_dev {
         struct task_struct *worker;
 };
 
-long vhost_dev_init(struct vhost_dev *, struct vhost_virtqueue *vqs, int nvqs);
+long vhost_dev_init(struct vhost_dev *, struct vhost_virtqueue **vqs, int nvqs);
 long vhost_dev_check_owner(struct vhost_dev *);
 long vhost_dev_reset_owner(struct vhost_dev *);
 void vhost_dev_cleanup(struct vhost_dev *, bool locked);