From 943b9fc261530670ca963e7de7e1a39a16f5691c Mon Sep 17 00:00:00 2001
From: Igor Mammedov <imammedo@redhat.com>
Date: Sun, 25 Feb 2018 21:00:24 -0500
Subject: [PATCH] qdev: Fix object reference leak in case device.realize()
 fails

If device doesn't have parent assined before its realize
is called, device_set_realized() will implicitly set parent
to '/machine/unattached'.

However device_set_realized() may fail after that point at
several other points leaving not realized object dangling
in '/machine/unattached' and as result caller of

obj = object_new()
obj->ref == 1
object_property_set_bool(obj,..., true, "realized",...)
obj->ref == 2
if (fail)
object_unref(obj);
obj->ref == 1

will get object leak instead of expected object destruction.

Fix it by making device_set_realized() to cleanup after itself
in case of failure.

Backports commit 69382d8b3e8600b349c191394d761dcb480502cf from qemu
---
 qemu/hw/core/qdev.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/qemu/hw/core/qdev.c b/qemu/hw/core/qdev.c
index 527c70a6..aaa4ec84 100644
--- a/qemu/hw/core/qdev.c
+++ b/qemu/hw/core/qdev.c
@@ -161,6 +161,10 @@ static int device_set_realized(struct uc_struct *uc, Object *obj, bool value, Er
     DeviceClass *dc = DEVICE_GET_CLASS(uc, dev);
     BusState *bus;
     Error *local_err = NULL;
+    // Unicorn: commented out
+    //bool unattached_parent = false;
+    //static int unattached_count;
+
 
     if (dev->hotplugged && !dc->hotpluggable) {
         error_setg(errp, QERR_DEVICE_NO_HOTPLUG, object_get_typename(obj));
@@ -168,14 +172,15 @@ static int device_set_realized(struct uc_struct *uc, Object *obj, bool value, Er
     }
 
     if (value && !dev->realized) {
+        // Unicorn: if'd out
 #if 0
         if (!obj->parent) {
-            static int unattached_count;
             gchar *name = g_strdup_printf("device[%d]", unattached_count++);
 
             object_property_add_child(container_get(qdev_get_machine(),
                                                     "/unattached"),
                                       name, obj, &error_abort);
+            unattached_parent = true;
             g_free(name);
         }
 #endif
@@ -238,6 +243,11 @@ post_realize_fail:
 
 fail:
     error_propagate(errp, local_err);
+    /* Unicorn: commented out
+    if (unattached_parent) {
+        object_unparent(OBJECT(dev));
+        unattached_count--;
+    }*/
     return -1;
 }