From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:52611)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <bharata@linux.vnet.ibm.com>) id 1bITaN-0001E2-EV
	for qemu-devel@nongnu.org; Thu, 30 Jun 2016 00:28:20 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <bharata@linux.vnet.ibm.com>) id 1bITaJ-0000nd-CL
	for qemu-devel@nongnu.org; Thu, 30 Jun 2016 00:28:19 -0400
Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:9385
	helo=mx0a-001b2d01.pphosted.com)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <bharata@linux.vnet.ibm.com>) id 1bITaI-0000nO-Sj
	for qemu-devel@nongnu.org; Thu, 30 Jun 2016 00:28:15 -0400
Received: from pps.filterd (m0098414.ppops.net [127.0.0.1])
	by mx0b-001b2d01.pphosted.com (8.16.0.11/8.16.0.11) with SMTP id
	u5U4JIaZ003288
	for <qemu-devel@nongnu.org>; Thu, 30 Jun 2016 00:28:13 -0400
Received: from e28smtp08.in.ibm.com (e28smtp08.in.ibm.com [125.16.236.8])
	by mx0b-001b2d01.pphosted.com with ESMTP id 23utc9vdxb-1
	(version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT)
	for <qemu-devel@nongnu.org>; Thu, 30 Jun 2016 00:28:13 -0400
Received: from localhost
	by e28smtp08.in.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use
	Only! Violators will be prosecuted
	for <qemu-devel@nongnu.org> from <bharata@linux.vnet.ibm.com>;
	Thu, 30 Jun 2016 09:58:09 +0530
Date: Thu, 30 Jun 2016 09:57:58 +0530
From: Bharata B Rao <bharata@linux.vnet.ibm.com>
Reply-To: bharata@linux.vnet.ibm.com
References: <146723340662.9665.6413150884317978000.stgit@bahia.lan>
	<146723342014.9665.3613446436074803191.stgit@bahia.lan>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <146723342014.9665.3613446436074803191.stgit@bahia.lan>
Message-Id: <20160630042758.GB21596@in.ibm.com>
Subject: Re: [Qemu-devel] [PATCH 1/8] spapr: drop reference on child object
 during core realization
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel/>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Greg Kurz <groug@kaod.org>
Cc: David Gibson <david@gibson.dropbear.id.au>, Peter Crosthwaite <crosthwaite.peter@gmail.com>, Benjamin Herrenschmidt <benh@kernel.crashing.org>, Alexander Graf <agraf@suse.de>, qemu-devel@nongnu.org, qemu-ppc@nongnu.org, Cedric Le Goater <clg@kaod.org>, Scott Wood <scottwood@freescale.com>, Paolo Bonzini <pbonzini@redhat.com>, Richard Henderson <rth@twiddle.net>

On Wed, Jun 29, 2016 at 10:50:20PM +0200, Greg Kurz wrote:
> When a core is being realized, we create a child object for each thread
> of the core.
> 
> The child is first initialized with object_initialize() which sets its ref
> count to 1, and then added to the core with object_property_add_child()
> which bumps the ref count to 2.
> 
> When the core gets released, object_unparent() decreases the ref count to 1,
> and we g_free() the object: we hence loose the reference on an unfinalized
> object. This is likely to cause random crashes.
> 
> Let's drop the extra reference as soon as we don't need it, after the
> thread is added to the core.
> 
> Signed-off-by: Greg Kurz <groug@kaod.org>

Reviewed-by: Bharata B Rao <bharata@linux.vnet.ibm.com>