Re: [Qemu-devel] [PATCH qemu] pci: Add missing drop of bus master AS reference

[Paolo Bonzini]

On 27/03/2017 06:40, Alexey Kardashevskiy wrote:
> The recent introduction of a bus master container added
> memory_region_add_subregion() into the PCI device registering path but
> missed memory_region_del_subregion() in the unregistering path leaving
> a reference to the root memory region of the new container.
> 
> This adds missing memory_region_del_subregion().
> 
> Fixes: 3716d5902d743 ("pci: introduce a bus master container")
> Signed-off-by: Alexey Kardashevskiy <address@hidden>
> ---
>  hw/pci/pci.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/hw/pci/pci.c b/hw/pci/pci.c
> index e6b08e1988..bd8043c460 100644
> --- a/hw/pci/pci.c
> +++ b/hw/pci/pci.c
> @@ -869,6 +869,8 @@ static void do_pci_unregister_device(PCIDevice *pci_dev)
>      pci_dev->bus->devices[pci_dev->devfn] = NULL;
>      pci_config_free(pci_dev);
>  
> +    memory_region_del_subregion(&pci_dev->bus_master_container_region,
> +                                &pci_dev->bus_master_enable_region);
>      address_space_destroy(&pci_dev->bus_master_as);
>  }
>  
> 

My own review fail.  The enable subregion would be deleted when a memory
region is finalized, but the enable subregions is keeping the owner
alive.  And until the owner is alive, the container region is not
deleted either.  So there is a reference count cycle, which we need to
break.

It's probably good to revisit commit 2e2b8eb ("memory: allow destroying
a non-empty MemoryRegion", 2015-10-01).  For 2.9,

Reviewed-by: Paolo Bonzini <address@hidden>

Paolo