Re: [Qemu-devel] Use-after-free during unrealize in system_reset

[Paolo Bonzini <pbonzini@redhat.com>]

Il 06/06/2014 11:03, Stefan Hajnoczi ha scritto:
> commit 5c21ce77d7e5643089ceec556c0408445d017f32
> Author: Bandan Das <bsd@redhat.com>
> Date:   Wed Mar 12 21:02:12 2014 +0100
>
>     qdev: Realize buses on device realization
>
>     Integrate (un)realization of child buses with realization/unrealization
>     of the device hosting them. Code in device_unparent() is reordered for
>     unrealization of buses to work as part of device unrealization.
>
>     That way no changes need to be made to bus instantiation.
>
>     Signed-off-by: Bandan Das <bsd@redhat.com>
>     Signed-off-by: Andreas Färber <afaerber@suse.de>

This hunk seems wrong.  Bandan, what was the reason for it?


@@ -841,13 +858,13 @@ static void device_unparent(Object *obj)
      QObject *event_data;
      bool have_realized = dev->realized;

+    if (dev->realized) {
+        object_property_set_bool(obj, false, "realized", NULL);
+    }
      while (dev->num_child_bus) {
          bus = QLIST_FIRST(&dev->child_bus);
          object_unparent(OBJECT(bus));
      }
-    if (dev->realized) {
-        object_property_set_bool(obj, false, "realized", NULL);
-    }
      if (dev->parent_bus) {
          bus_remove_child(dev->parent_bus, dev);
          object_unref(OBJECT(dev->parent_bus));



Paolo