mirrors-yuzu-emu/unicorn
1
0
Fork 0
mirror of https://github.com/yuzu-emu/unicorn synced 2024-11-24 13:38:26 +00:00
Code Issues Projects Releases Packages Wiki Activity

qdev: Fix object reference leak in case device.realize() fails

Browse source 
If device doesn't have parent assined before its realize
is called, device_set_realized() will implicitly set parent
to '/machine/unattached'.

However device_set_realized() may fail after that point at
several other points leaving not realized object dangling
in '/machine/unattached' and as result caller of

obj = object_new()
obj->ref == 1
object_property_set_bool(obj,..., true, "realized",...)
obj->ref == 2
if (fail)
object_unref(obj);
obj->ref == 1

will get object leak instead of expected object destruction.

Fix it by making device_set_realized() to cleanup after itself
in case of failure.

Backports commit 69382d8b3e8600b349c191394d761dcb480502cf from qemu
This commit is contained in:
Igor Mammedov 2018-02-25 21:00:24 -05:00 committed by Lioncash
parent 62c89b9cd4
commit 943b9fc261
No known key found for this signature in database
GPG key ID: 4E3C3CC1031BA9C7
1 changed files with 11 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
qemu/hw/core/qdev.c
View file

@ -161,6 +161,10 @@ static int device_set_realized(struct uc_struct *uc, Object *obj, bool value, Er
DeviceClass *dc = DEVICE_GET_CLASS(uc, dev);
BusState *bus;
Error *local_err = NULL;
// Unicorn: commented out
//bool unattached_parent = false;
//static int unattached_count;
if (dev->hotplugged && !dc->hotpluggable) {
error_setg(errp, QERR_DEVICE_NO_HOTPLUG, object_get_typename(obj));
@ -168,14 +172,15 @@ static int device_set_realized(struct uc_struct *uc, Object *obj, bool value, Er
}
if (value && !dev->realized) {
// Unicorn: if'd out
#if 0
if (!obj->parent) {
static int unattached_count;
gchar *name = g_strdup_printf("device[%d]", unattached_count++);
object_property_add_child(container_get(qdev_get_machine(),
"/unattached"),
name, obj, &error_abort);
unattached_parent = true;
g_free(name);
}
#endif
@ -238,6 +243,11 @@ post_realize_fail:
fail:
error_propagate(errp, local_err);
/* Unicorn: commented out
if (unattached_parent) {
object_unparent(OBJECT(dev));
unattached_count--;
}*/
return -1;
}