On Sat, Aug 15, 2026 at 01:48:21AM +0800, Zhang Chen wrote:
> diff --git a/hw/virtio/iothread-vq-mapping.c b/hw/virtio/iothread-vq-mapping.c
> index 55ce62986c..1859d39630 100644
> --- a/hw/virtio/iothread-vq-mapping.c
> +++ b/hw/virtio/iothread-vq-mapping.c
> @@ -77,6 +77,7 @@ bool iothread_vq_mapping_apply(
>          IOThreadVirtQueueMappingList *list,
>          AioContext **vq_aio_context,
>          uint16_t num_queues,
> +        char *holder,

const char * is clearer. It indicates that this function doesn't modify
or free its argument (making ownership clear).

>          Error **errp)
>  {
>      IOThreadVirtQueueMappingList *node;
> @@ -93,10 +94,13 @@ bool iothread_vq_mapping_apply(
>  
>      for (node = list; node; node = node->next) {
>          IOThread *iothread = iothread_by_id(node->value->iothread);
> -        AioContext *ctx = iothread_get_aio_context(iothread);
> +        const IOThreadHolder io_holder = {
> +            .type = IO_THREAD_HOLDER_KIND_QOM_OBJECT,
> +            .u.qom_object.qom_path = holder,
> +        };
>  
> -        /* Released in virtio_blk_vq_aio_context_cleanup() */
> -        object_ref(OBJECT(iothread));
> +        AioContext *ctx = iothread_ref_and_get_aio_context(iothread,
> +                                                           &io_holder);
>  
>          if (node->value->vqs) {
>              uint16List *vq;
> @@ -120,13 +124,19 @@ bool iothread_vq_mapping_apply(
>      return true;
>  }
>  
> -void iothread_vq_mapping_cleanup(IOThreadVirtQueueMappingList *list)
> +void iothread_vq_mapping_cleanup(IOThreadVirtQueueMappingList *list,
> +                                 char *holder)

const char *