[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 4/9] qdev: Fix object reference leak in case device.r
From: |
Eduardo Habkost |
Subject: |
[Qemu-devel] [PULL 4/9] qdev: Fix object reference leak in case device.realize() fails |
Date: |
Wed, 27 Jul 2016 11:29:16 -0300 |
From: Igor Mammedov <address@hidden>
If device doesn't have parent assined before its realize
is called, device_set_realized() will implicitly set parent
to '/machine/unattached'.
However device_set_realized() may fail after that point at
several other points leaving not realized object dangling
in '/machine/unattached' and as result caller of
obj = object_new()
obj->ref == 1
object_property_set_bool(obj,..., true, "realized",...)
obj->ref == 2
if (fail)
object_unref(obj);
obj->ref == 1
will get object leak instead of expected object destruction.
Fix it by making device_set_realized() to cleanup after itself
in case of failure.
Signed-off-by: Igor Mammedov <address@hidden>
Reviewed-by: David Gibson <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>
---
hw/core/qdev.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/hw/core/qdev.c b/hw/core/qdev.c
index 6680089..ee4a083 100644
--- a/hw/core/qdev.c
+++ b/hw/core/qdev.c
@@ -885,6 +885,8 @@ static void device_set_realized(Object *obj, bool value,
Error **errp)
HotplugHandler *hotplug_ctrl;
BusState *bus;
Error *local_err = NULL;
+ bool unattached_parent = false;
+ static int unattached_count;
if (dev->hotplugged && !dc->hotpluggable) {
error_setg(errp, QERR_DEVICE_NO_HOTPLUG, object_get_typename(obj));
@@ -893,12 +895,12 @@ static void device_set_realized(Object *obj, bool value,
Error **errp)
if (value && !dev->realized) {
if (!obj->parent) {
- static int unattached_count;
gchar *name = g_strdup_printf("device[%d]", unattached_count++);
object_property_add_child(container_get(qdev_get_machine(),
"/unattached"),
name, obj, &error_abort);
+ unattached_parent = true;
g_free(name);
}
@@ -987,6 +989,10 @@ post_realize_fail:
fail:
error_propagate(errp, local_err);
+ if (unattached_parent) {
+ object_unparent(OBJECT(dev));
+ unattached_count--;
+ }
}
static bool device_get_hotpluggable(Object *obj, Error **errp)
--
2.5.5
- [Qemu-devel] [PULL 0/9] x86 and machine queue, 2016-07-27, Eduardo Habkost, 2016/07/27
- [Qemu-devel] [PULL 1/9] exec: Reduce CONFIG_USER_ONLY ifdeffenery, Eduardo Habkost, 2016/07/27
- [Qemu-devel] [PULL 2/9] exec: Don't use cpu_index to detect if cpu_exec_init()'s been called, Eduardo Habkost, 2016/07/27
- [Qemu-devel] [PULL 3/9] exec: Set cpu_index only if it's not been explictly set, Eduardo Habkost, 2016/07/27
- [Qemu-devel] [PULL 4/9] qdev: Fix object reference leak in case device.realize() fails,
Eduardo Habkost <=
- [Qemu-devel] [PULL 6/9] Revert "pc: Enforce adding CPUs contiguously and removing them in opposite order", Eduardo Habkost, 2016/07/27
- [Qemu-devel] [PULL 5/9] pc: Init CPUState->cpu_index with index in possible_cpus[], Eduardo Habkost, 2016/07/27
- [Qemu-devel] [PULL 7/9] machine: Add comment to abort path in machine_set_kernel_irqchip, Eduardo Habkost, 2016/07/27
- [Qemu-devel] [PULL 8/9] qdev: ignore GlobalProperty.errp for hotplugged devices, Eduardo Habkost, 2016/07/27
- [Qemu-devel] [PULL 9/9] vl: exit if a bad property value is passed to -global, Eduardo Habkost, 2016/07/27
- Re: [Qemu-devel] [PULL 0/9] x86 and machine queue, 2016-07-27, Peter Maydell, 2016/07/28