diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c
index e451ebdb3afdc340cb474d10f39e515285099ea9..fcbaa0466d9933ca4ef12635c5f25a12427c88f9 100644
--- a/src/qemu/qemu_cgroup.c
+++ b/src/qemu/qemu_cgroup.c
@@ -375,26 +375,23 @@ qemuSetupHostdevCgroup(virDomainObjPtr vm,
                        virDomainHostdevDefPtr dev)
 {
     qemuDomainObjPrivatePtr priv = vm->privateData;
-    char **path = NULL;
-    int *perms = NULL;
-    size_t i, npaths = 0;
+    g_autofree char *path = NULL;
+    int perms;
     int rv, ret = -1;
 
     if (!virCgroupHasController(priv->cgroup, VIR_CGROUP_CONTROLLER_DEVICES))
         return 0;
 
-    if (qemuDomainGetHostdevPath(NULL, dev, false, &npaths, &path, &perms) < 0)
+    if (qemuDomainGetHostdevPath(dev, &path, &perms) < 0)
         goto cleanup;
 
-    for (i = 0; i < npaths; i++) {
-        VIR_DEBUG("Cgroup allow %s perms=%d", path[i], perms[i]);
-        rv = virCgroupAllowDevicePath(priv->cgroup, path[i], perms[i], false);
-        virDomainAuditCgroupPath(vm, priv->cgroup, "allow", path[i],
-                                 virCgroupGetDevicePermsString(perms[i]),
-                                 rv);
-        if (rv < 0)
-            goto cleanup;
-    }
+    VIR_DEBUG("Cgroup allow %s perms=%d", path, perms);
+    rv = virCgroupAllowDevicePath(priv->cgroup, path, perms, false);
+    virDomainAuditCgroupPath(vm, priv->cgroup, "allow", path,
+                             virCgroupGetDevicePermsString(perms),
+                             rv);
+    if (rv < 0)
+        goto cleanup;
 
     if (qemuHostdevNeedsVFIO(dev)) {
         VIR_DEBUG("Cgroup allow %s perms=%d", QEMU_DEV_VFIO, VIR_CGROUP_DEVICE_RW);
@@ -409,10 +406,6 @@ qemuSetupHostdevCgroup(virDomainObjPtr vm,
     ret = 0;
 
  cleanup:
-    for (i = 0; i < npaths; i++)
-        VIR_FREE(path[i]);
-    VIR_FREE(path);
-    VIR_FREE(perms);
     return ret;
 }
 
@@ -433,26 +426,22 @@ qemuTeardownHostdevCgroup(virDomainObjPtr vm,
                           virDomainHostdevDefPtr dev)
 {
     qemuDomainObjPrivatePtr priv = vm->privateData;
-    char **path = NULL;
-    size_t i, npaths = 0;
+    g_autofree char *path = NULL;
     int rv, ret = -1;
 
     if (!virCgroupHasController(priv->cgroup, VIR_CGROUP_CONTROLLER_DEVICES))
         return 0;
 
-    if (qemuDomainGetHostdevPath(vm->def, dev, true,
-                                 &npaths, &path, NULL) < 0)
+    if (qemuDomainGetHostdevPath(dev, &path, NULL) < 0)
         goto cleanup;
 
-    for (i = 0; i < npaths; i++) {
-        VIR_DEBUG("Cgroup deny %s", path[i]);
-        rv = virCgroupDenyDevicePath(priv->cgroup, path[i],
-                                     VIR_CGROUP_DEVICE_RWM, false);
-        virDomainAuditCgroupPath(vm, priv->cgroup,
-                                 "deny", path[i], "rwm", rv);
-        if (rv < 0)
-            goto cleanup;
-    }
+    VIR_DEBUG("Cgroup deny %s", path);
+    rv = virCgroupDenyDevicePath(priv->cgroup, path,
+                                 VIR_CGROUP_DEVICE_RWM, false);
+    virDomainAuditCgroupPath(vm, priv->cgroup,
+                             "deny", path, "rwm", rv);
+    if (rv < 0)
+        goto cleanup;
 
     if (qemuHostdevNeedsVFIO(dev) &&
         !qemuDomainNeedsVFIO(vm->def)) {
@@ -467,9 +456,6 @@ qemuTeardownHostdevCgroup(virDomainObjPtr vm,
 
     ret = 0;
  cleanup:
-    for (i = 0; i < npaths; i++)
-        VIR_FREE(path[i]);
-    VIR_FREE(path);
     return ret;
 }
 
diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
index 5d2758bc197ec7f7905e76a019d662f4f7194321..e8476abb3693954b7966aadb1afc2ca1edfd476f 100644
--- a/src/qemu/qemu_domain.c
+++ b/src/qemu/qemu_domain.c
@@ -13822,29 +13822,23 @@ qemuDomainNeedsVFIO(const virDomainDef *def)
 
 /**
  * qemuDomainGetHostdevPath:
- * @def: domain definition
  * @dev: host device definition
- * @teardown: true if device will be removed
- * @npaths: number of items in @path and @perms arrays
  * @path: resulting path to @dev
  * @perms: Optional pointer to VIR_CGROUP_DEVICE_* perms
  *
  * For given device @dev fetch its host path and store it at
- * @path. If a device requires other paths to be present/allowed
- * they are stored in the @path array after the actual path.
- * Optionally, caller can get @perms on the path (e.g. rw/ro).
+ * @path. Optionally, caller can get @perms on the path (e.g.
+ * rw/ro).
  *
- * The caller is responsible for freeing the memory.
+ * The caller is responsible for freeing the @path when no longer
+ * needed.
  *
  * Returns 0 on success, -1 otherwise.
  */
 int
-qemuDomainGetHostdevPath(virDomainDefPtr def,
-                         virDomainHostdevDefPtr dev,
-                         bool teardown,
-                         size_t *npaths,
-                         char ***path,
-                         int **perms)
+qemuDomainGetHostdevPath(virDomainHostdevDefPtr dev,
+                         char **path,
+                         int *perms)
 {
     int ret = -1;
     virDomainHostdevSubsysUSBPtr usbsrc = &dev->source.subsys.u.usb;
@@ -13857,14 +13851,9 @@ qemuDomainGetHostdevPath(virDomainDefPtr def,
     g_autoptr(virSCSIDevice) scsi = NULL;
     g_autoptr(virSCSIVHostDevice) host = NULL;
     g_autofree char *tmpPath = NULL;
-    bool includeVFIO = false;
-    char **tmpPaths = NULL;
     g_autofree int *tmpPerms = NULL;
-    size_t tmpNpaths = 0;
     int perm = 0;
 
-    *npaths = 0;
-
     switch ((virDomainHostdevMode) dev->mode) {
     case VIR_DOMAIN_HOSTDEV_MODE_SUBSYS:
         switch ((virDomainHostdevSubsysType)dev->source.subsys.type) {
@@ -13881,12 +13870,6 @@ qemuDomainGetHostdevPath(virDomainDefPtr def,
                     goto cleanup;
 
                 perm = VIR_CGROUP_DEVICE_RW;
-                if (teardown) {
-                    if (!virDomainDefHasVFIOHostdev(def))
-                        includeVFIO = true;
-                } else {
-                    includeVFIO = true;
-                }
             }
             break;
 
@@ -13942,7 +13925,6 @@ qemuDomainGetHostdevPath(virDomainDefPtr def,
             if (!(tmpPath = virMediatedDeviceGetIOMMUGroupDev(mdevsrc->uuidstr)))
                 goto cleanup;
 
-            includeVFIO = true;
             perm = VIR_CGROUP_DEVICE_RW;
             break;
         case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_LAST:
@@ -13956,36 +13938,11 @@ qemuDomainGetHostdevPath(virDomainDefPtr def,
         break;
     }
 
-    if (tmpPath) {
-        size_t toAlloc = 1;
-
-        if (includeVFIO)
-            toAlloc = 2;
-
-        if (VIR_ALLOC_N(tmpPaths, toAlloc) < 0 ||
-            VIR_ALLOC_N(tmpPerms, toAlloc) < 0)
-            goto cleanup;
-        tmpPaths[0] = g_strdup(tmpPath);
-        tmpNpaths = toAlloc;
-        tmpPerms[0] = perm;
-
-        if (includeVFIO) {
-            tmpPaths[1] = g_strdup(QEMU_DEV_VFIO);
-            tmpPerms[1] = VIR_CGROUP_DEVICE_RW;
-        }
-    }
-
-    *npaths = tmpNpaths;
-    tmpNpaths = 0;
-    *path = tmpPaths;
-    tmpPaths = NULL;
-    if (perms) {
-        *perms = tmpPerms;
-        tmpPerms = NULL;
-    }
+    *path = g_steal_pointer(&tmpPath);
+    if (perms)
+        *perms = perm;
     ret = 0;
  cleanup:
-    virStringListFreeCount(tmpPaths, tmpNpaths);
     return ret;
 }
 
@@ -14486,16 +14443,13 @@ qemuDomainSetupHostdev(virQEMUDriverConfigPtr cfg G_GNUC_UNUSED,
                        const struct qemuDomainCreateDeviceData *data)
 {
     int ret = -1;
-    char **path = NULL;
-    size_t i, npaths = 0;
+    g_autofree char *path = NULL;
 
-    if (qemuDomainGetHostdevPath(NULL, dev, false, &npaths, &path, NULL) < 0)
+    if (qemuDomainGetHostdevPath(dev, &path, NULL) < 0)
         goto cleanup;
 
-    for (i = 0; i < npaths; i++) {
-        if (qemuDomainCreateDevice(path[i], data, false) < 0)
-            goto cleanup;
-    }
+    if (qemuDomainCreateDevice(path, data, false) < 0)
+        goto cleanup;
 
     if (qemuHostdevNeedsVFIO(dev) &&
         qemuDomainCreateDevice(QEMU_DEV_VFIO, data, false) < 0)
@@ -14503,9 +14457,6 @@ qemuDomainSetupHostdev(virQEMUDriverConfigPtr cfg G_GNUC_UNUSED,
 
     ret = 0;
  cleanup:
-    for (i = 0; i < npaths; i++)
-        VIR_FREE(path[i]);
-    VIR_FREE(path);
     return ret;
 }
 
@@ -15540,13 +15491,12 @@ qemuDomainNamespaceSetupHostdev(virDomainObjPtr vm,
                                 virDomainHostdevDefPtr hostdev)
 {
     int ret = -1;
-    char **paths = NULL;
-    size_t i, npaths = 0;
+    g_autofree char *path = NULL;
 
-    if (qemuDomainGetHostdevPath(NULL, hostdev, false, &npaths, &paths, NULL) < 0)
+    if (qemuDomainGetHostdevPath(hostdev, &path, NULL) < 0)
         goto cleanup;
 
-    if (qemuDomainNamespaceMknodPaths(vm, (const char **)paths, npaths) < 0)
+    if (qemuDomainNamespaceMknodPath(vm, path) < 0)
         goto cleanup;
 
     if (qemuHostdevNeedsVFIO(hostdev) &&
@@ -15556,9 +15506,6 @@ qemuDomainNamespaceSetupHostdev(virDomainObjPtr vm,
 
     ret = 0;
  cleanup:
-    for (i = 0; i < npaths; i++)
-        VIR_FREE(paths[i]);
-    VIR_FREE(paths);
     return ret;
 }
 
@@ -15579,14 +15526,12 @@ qemuDomainNamespaceTeardownHostdev(virDomainObjPtr vm,
                                    virDomainHostdevDefPtr hostdev)
 {
     int ret = -1;
-    char **paths = NULL;
-    size_t i, npaths = 0;
+    g_autofree char *path = NULL;
 
-    if (qemuDomainGetHostdevPath(vm->def, hostdev, true,
-                                 &npaths, &paths, NULL) < 0)
+    if (qemuDomainGetHostdevPath(hostdev, &path, NULL) < 0)
         goto cleanup;
 
-    if (qemuDomainNamespaceUnlinkPaths(vm, (const char **)paths, npaths) < 0)
+    if (qemuDomainNamespaceUnlinkPath(vm, path) < 0)
         goto cleanup;
 
     if (qemuHostdevNeedsVFIO(hostdev) &&
@@ -15596,9 +15541,6 @@ qemuDomainNamespaceTeardownHostdev(virDomainObjPtr vm,
 
     ret = 0;
  cleanup:
-    for (i = 0; i < npaths; i++)
-        VIR_FREE(paths[i]);
-    VIR_FREE(paths);
     return ret;
 }
 
diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h
index 4c47b62b589002088cfea41aa2c1d953c0bd009f..cc94f1743ce23920bed53ce7e12cad6cfef7d8dd 100644
--- a/src/qemu/qemu_domain.h
+++ b/src/qemu/qemu_domain.h
@@ -1099,12 +1099,9 @@ bool qemuDomainSupportsVideoVga(virDomainVideoDefPtr video,
 
 bool qemuDomainNeedsVFIO(const virDomainDef *def);
 
-int qemuDomainGetHostdevPath(virDomainDefPtr def,
-                             virDomainHostdevDefPtr dev,
-                             bool teardown,
-                             size_t *npaths,
-                             char ***path,
-                             int **perms);
+int qemuDomainGetHostdevPath(virDomainHostdevDefPtr dev,
+                             char **path,
+                             int *perms);
 
 int qemuDomainBuildNamespace(virQEMUDriverConfigPtr cfg,
                              virSecurityManagerPtr mgr,