From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:48149) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YQNOW-00042E-0X for qemu-devel@nongnu.org; Tue, 24 Feb 2015 16:52:00 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YQNOP-0006hR-NX for qemu-devel@nongnu.org; Tue, 24 Feb 2015 16:51:55 -0500 Received: from e7.ny.us.ibm.com ([32.97.182.137]:51691) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YQNOP-0006hD-F4 for qemu-devel@nongnu.org; Tue, 24 Feb 2015 16:51:49 -0500 Received: from /spool/local by e7.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 24 Feb 2015 16:51:49 -0500 From: Michael Roth Date: Tue, 24 Feb 2015 15:47:59 -0600 Message-Id: <1424814498-6993-25-git-send-email-mdroth@linux.vnet.ibm.com> In-Reply-To: <1424814498-6993-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1424814498-6993-1-git-send-email-mdroth@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH 24/43] PPC: Fix crash on spapr_tce_table_finalize() List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Alexander Graf , qemu-stable@nongnu.org, David Gibson From: David Gibson spapr_tce_table_finalize() can SEGV if the object was not previously realized. In particular this can be triggered by running qemu-system-ppc -device spapr-tce-table,? The basic problem is that we have mismatched initialization versus finalization: spapr_tce_table_finalize() is attempting to undo things that are done in spapr_tce_table_realize(), not an instance_init function. Therefore, replace spapr_tce_table_finalize() with spapr_tce_table_unrealize(). Signed-off-by: David Gibson Cc: qemu-stable@nongnu.org Signed-off-by: Alexander Graf (cherry picked from commit 5f9490de566c5b092a6cfedc3c7a37a9c9dee917) Signed-off-by: Michael Roth --- hw/ppc/spapr_iommu.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c index 6c91d8e..da47474 100644 --- a/hw/ppc/spapr_iommu.c +++ b/hw/ppc/spapr_iommu.c @@ -173,9 +173,9 @@ sPAPRTCETable *spapr_tce_new_table(DeviceState *owner, uint32_t liobn, return tcet; } -static void spapr_tce_table_finalize(Object *obj) +static void spapr_tce_table_unrealize(DeviceState *dev, Error **errp) { - sPAPRTCETable *tcet = SPAPR_TCE_TABLE(obj); + sPAPRTCETable *tcet = SPAPR_TCE_TABLE(dev); QLIST_REMOVE(tcet, list); @@ -420,6 +420,7 @@ static void spapr_tce_table_class_init(ObjectClass *klass, void *data) DeviceClass *dc = DEVICE_CLASS(klass); dc->init = spapr_tce_table_realize; dc->reset = spapr_tce_reset; + dc->unrealize = spapr_tce_table_unrealize; QLIST_INIT(&spapr_tce_tables); @@ -435,7 +436,6 @@ static TypeInfo spapr_tce_table_info = { .parent = TYPE_DEVICE, .instance_size = sizeof(sPAPRTCETable), .class_init = spapr_tce_table_class_init, - .instance_finalize = spapr_tce_table_finalize, }; static void register_types(void) -- 1.9.1