From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:54062) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SiEJG-0007dP-PR for qemu-devel@nongnu.org; Fri, 22 Jun 2012 20:34:44 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SiEJF-0007yV-42 for qemu-devel@nongnu.org; Fri, 22 Jun 2012 20:34:42 -0400 Received: from mail-pb0-f45.google.com ([209.85.160.45]:36193) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SiEJE-0007st-RD for qemu-devel@nongnu.org; Fri, 22 Jun 2012 20:34:41 -0400 Received: by mail-pb0-f45.google.com with SMTP id ro12so4321638pbb.4 for ; Fri, 22 Jun 2012 17:34:39 -0700 (PDT) Sender: fluxion From: Michael Roth Date: Fri, 22 Jun 2012 19:33:24 -0500 Message-Id: <1340411610-22596-21-git-send-email-mdroth@linux.vnet.ibm.com> In-Reply-To: <1340411610-22596-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1340411610-22596-1-git-send-email-mdroth@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH stable-1.1 20/26] qdev: release parent properties on dc->init failure List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: aliguori@us.ibm.com From: Jason Baron While looking into hot-plugging bridges, I can create a qemu segfault via: $ device_add pci-bridge Bridge chassis not specified. Each bridge is required to be assigned a unique chassis id > 0. ** ERROR:qom/object.c:389:object_delete: assertion failed: (obj->ref == 0) I'm proposing to fix this by adding a call to 'object_unparent()', before the call to qdev_free(). I see there is already a precedent for this usage pattern as seen in qdev_simple_unplug_cb(): /* can be used as ->unplug() callback for the simple cases */ int qdev_simple_unplug_cb(DeviceState *dev) { /* just zap it */ object_unparent(OBJECT(dev)); qdev_free(dev); return 0; } Signed-off-by: Jason Baron Signed-off-by: Michael S. Tsirkin --- hw/qdev.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/hw/qdev.c b/hw/qdev.c index 6a8f6bd..af419b9 100644 --- a/hw/qdev.c +++ b/hw/qdev.c @@ -150,6 +150,7 @@ int qdev_init(DeviceState *dev) rc = dc->init(dev); if (rc < 0) { + object_unparent(OBJECT(dev)); qdev_free(dev); return rc; } -- 1.7.4.1