Re: [Qemu-devel] Use-after-free during unrealize in system_reset

["Michael S. Tsirkin" <mst@redhat.com>]

On Fri, Jun 06, 2014 at 11:52:46AM +0200, Paolo Bonzini wrote:
> Il 06/06/2014 11:03, Stefan Hajnoczi ha scritto:
> >commit 5c21ce77d7e5643089ceec556c0408445d017f32
> >Author: Bandan Das <bsd@redhat.com>
> >Date:   Wed Mar 12 21:02:12 2014 +0100
> >
> >    qdev: Realize buses on device realization
> >
> >    Integrate (un)realization of child buses with realization/unrealization
> >    of the device hosting them. Code in device_unparent() is reordered for
> >    unrealization of buses to work as part of device unrealization.
> >
> >    That way no changes need to be made to bus instantiation.
> >
> >    Signed-off-by: Bandan Das <bsd@redhat.com>
> >    Signed-off-by: Andreas Färber <afaerber@suse.de>
> 
> This hunk seems wrong.  Bandan, what was the reason for it?
> 
> 
> @@ -841,13 +858,13 @@ static void device_unparent(Object *obj)
>      QObject *event_data;
>      bool have_realized = dev->realized;
> 
> +    if (dev->realized) {
> +        object_property_set_bool(obj, false, "realized", NULL);
> +    }
>      while (dev->num_child_bus) {
>          bus = QLIST_FIRST(&dev->child_bus);
>          object_unparent(OBJECT(bus));
>      }
> -    if (dev->realized) {
> -        object_property_set_bool(obj, false, "realized", NULL);
> -    }
>      if (dev->parent_bus) {
>          bus_remove_child(dev->parent_bus, dev);
>          object_unref(OBJECT(dev->parent_bus));
> 

Tested-by: Michael S. Tsirkin <mst@redhat.com>



> 
> Paolo