From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50723) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YXudj-0001Zw-8e for qemu-devel@nongnu.org; Tue, 17 Mar 2015 12:46:48 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YXude-00089I-AV for qemu-devel@nongnu.org; Tue, 17 Mar 2015 12:46:47 -0400 Received: from cantor2.suse.de ([195.135.220.15]:55524 helo=mx2.suse.de) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YXude-000898-3x for qemu-devel@nongnu.org; Tue, 17 Mar 2015 12:46:42 -0400 From: =?UTF-8?q?Andreas=20F=C3=A4rber?= Date: Tue, 17 Mar 2015 17:46:36 +0100 Message-Id: <1426610796-27439-1-git-send-email-afaerber@suse.de> In-Reply-To: <1426024655-17561-2-git-send-email-ehabkost@redhat.com> References: <1426024655-17561-2-git-send-email-ehabkost@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Subject: [Qemu-devel] [PATCH for-next] pc: Ensure non-zero CPU ref count after attaching to ICC bus List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Paolo Bonzini , Richard Henderson , "Michael S. Tsirkin" , ehabkost@redhat.com, =?UTF-8?q?Andreas=20F=C3=A4rber?= Setting the parent bus of a device increases its ref count, which we ultimately want to level out. However it is only safe to do so after the last reference to the device in local code, as qom-set or similar operati= ons might decrease the ref count. Therefore move the object_unref() from pc_new_cpu() into its callers. The APIC operations on the last CPU in pc_cpus_init() are still potential= ly insecure, but that is beyond the scope of this code movement. Signed-off-by: Andreas F=C3=A4rber --- hw/i386/pc.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/hw/i386/pc.c b/hw/i386/pc.c index 4b46c29..84aa174 100644 --- a/hw/i386/pc.c +++ b/hw/i386/pc.c @@ -1007,7 +1007,6 @@ static X86CPU *pc_new_cpu(const char *cpu_model, in= t64_t apic_id, } =20 qdev_set_parent_bus(DEVICE(cpu), qdev_get_child_bus(icc_bridge, "icc= ")); - object_unref(OBJECT(cpu)); =20 object_property_set_int(OBJECT(cpu), apic_id, "apic-id", &local_err)= ; object_property_set_bool(OBJECT(cpu), true, "realized", &local_err); @@ -1026,7 +1025,9 @@ static const char *current_cpu_model; void pc_hot_add_cpu(const int64_t id, Error **errp) { DeviceState *icc_bridge; + X86CPU *cpu; int64_t apic_id =3D x86_cpu_apic_id_from_index(id); + Error *local_err =3D NULL; =20 if (id < 0) { error_setg(errp, "Invalid CPU id: %" PRIi64, id); @@ -1054,7 +1055,12 @@ void pc_hot_add_cpu(const int64_t id, Error **errp= ) =20 icc_bridge =3D DEVICE(object_resolve_path_type("icc-bridge", TYPE_ICC_BRIDGE, NULL))= ; - pc_new_cpu(current_cpu_model, apic_id, icc_bridge, errp); + cpu =3D pc_new_cpu(current_cpu_model, apic_id, icc_bridge, &local_er= r); + if (local_err) { + error_propagate(errp, local_err); + return; + } + object_unref(OBJECT(cpu)); } =20 void pc_cpus_init(const char *cpu_model, DeviceState *icc_bridge) @@ -1088,6 +1094,7 @@ void pc_cpus_init(const char *cpu_model, DeviceStat= e *icc_bridge) error_report_err(error); exit(1); } + object_unref(OBJECT(cpu)); } =20 /* map APIC MMIO area if CPU has APIC */ --=20 2.1.4