[Qemu-devel] [PATCH] pci: cleanly backout of pci_qdev_init()

[Qemu-devel] [PATCH] pci: cleanly backout of pci_qdev_init()

[Alex Williamson]

If the init function of a device fails, as might happen with device
assignment, we never undo the work done by do_pci_register_device().
This not only causes a bit of a memory leak, but also leaves a bogus
pointer in the bus devices array that can cause a segfault or
garbage data from 'info pci'.

Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
---

 hw/pci.c |   17 ++++++++++++-----
 1 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/hw/pci.c b/hw/pci.c
index f167436..3d3560e 100644
--- a/hw/pci.c
+++ b/hw/pci.c
@@ -625,6 +625,14 @@ static PCIDevice *do_pci_register_device(PCIDevice *pci_dev, PCIBus *bus,
     return pci_dev;
 }
 
+static void do_pci_unregister_device(PCIDevice *pci_dev)
+{
+    qemu_free_irqs(pci_dev->irq);
+    pci_dev->bus->devices[pci_dev->devfn] = NULL;
+    pci_config_free(pci_dev);
+    return;
+}
+
 PCIDevice *pci_register_device(PCIBus *bus, const char *name,
                                int instance_size, int devfn,
                                PCIConfigReadFunc *config_read,
@@ -680,10 +688,7 @@ static int pci_unregister_device(DeviceState *dev)
         return ret;
 
     pci_unregister_io_regions(pci_dev);
-
-    qemu_free_irqs(pci_dev->irq);
-    pci_dev->bus->devices[pci_dev->devfn] = NULL;
-    pci_config_free(pci_dev);
+    do_pci_unregister_device(pci_dev);
     return 0;
 }
 
@@ -1652,8 +1657,10 @@ static int pci_qdev_init(DeviceState *qdev, DeviceInfo *base)
     if (pci_dev == NULL)
         return -1;
     rc = info->init(pci_dev);
-    if (rc != 0)
+    if (rc != 0) {
+        do_pci_unregister_device(pci_dev);
         return rc;
+    }
 
     /* rom loading */
     if (pci_dev->romfile == NULL && info->romfile != NULL)

Re: [Qemu-devel] [PATCH] pci: cleanly backout of pci_qdev_init()

[Markus Armbruster]

Alex Williamson <alex.williamson@redhat.com> writes:

> If the init function of a device fails, as might happen with device
> assignment, we never undo the work done by do_pci_register_device().
> This not only causes a bit of a memory leak, but also leaves a bogus
> pointer in the bus devices array that can cause a segfault or
> garbage data from 'info pci'.
>
> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

Looks good to me.  Gerd?

Re: [Qemu-devel] [PATCH] pci: cleanly backout of pci_qdev_init()

[Gerd Hoffmann]

On 05/11/10 11:25, Markus Armbruster wrote:
> Alex Williamson<alex.williamson@redhat.com>  writes:
>
>> If the init function of a device fails, as might happen with device
>> assignment, we never undo the work done by do_pci_register_device().
>> This not only causes a bit of a memory leak, but also leaves a bogus
>> pointer in the bus devices array that can cause a segfault or
>> garbage data from 'info pci'.
>>
>> Signed-off-by: Alex Williamson<alex.williamson@redhat.com>
>
> Looks good to me.  Gerd?

Yes, looks fine.

cheers,
   Gerd

Re: [Qemu-devel] [PATCH] pci: cleanly backout of pci_qdev_init()

[Blue Swirl]

On 5/10/10, Alex Williamson <alex.williamson@redhat.com> wrote:
> If the init function of a device fails, as might happen with device
>  assignment, we never undo the work done by do_pci_register_device().
>  This not only causes a bit of a memory leak, but also leaves a bogus
>  pointer in the bus devices array that can cause a segfault or
>  garbage data from 'info pci'.
>
>  Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
>  ---
>
>   hw/pci.c |   17 ++++++++++++-----
>   1 files changed, 12 insertions(+), 5 deletions(-)
>
>  diff --git a/hw/pci.c b/hw/pci.c
>  index f167436..3d3560e 100644
>  --- a/hw/pci.c
>  +++ b/hw/pci.c
>  @@ -625,6 +625,14 @@ static PCIDevice *do_pci_register_device(PCIDevice *pci_dev, PCIBus *bus,
>      return pci_dev;
>   }
>
>  +static void do_pci_unregister_device(PCIDevice *pci_dev)
>  +{
>  +    qemu_free_irqs(pci_dev->irq);
>  +    pci_dev->bus->devices[pci_dev->devfn] = NULL;
>  +    pci_config_free(pci_dev);
>  +    return;

Isn't this 'return' useless?

>  +}
>  +
>   PCIDevice *pci_register_device(PCIBus *bus, const char *name,
>                                 int instance_size, int devfn,
>                                 PCIConfigReadFunc *config_read,
>  @@ -680,10 +688,7 @@ static int pci_unregister_device(DeviceState *dev)
>          return ret;
>
>      pci_unregister_io_regions(pci_dev);
>  -
>  -    qemu_free_irqs(pci_dev->irq);
>  -    pci_dev->bus->devices[pci_dev->devfn] = NULL;
>  -    pci_config_free(pci_dev);
>  +    do_pci_unregister_device(pci_dev);
>      return 0;
>   }
>
>  @@ -1652,8 +1657,10 @@ static int pci_qdev_init(DeviceState *qdev, DeviceInfo *base)
>      if (pci_dev == NULL)
>          return -1;
>      rc = info->init(pci_dev);
>  -    if (rc != 0)
>  +    if (rc != 0) {
>  +        do_pci_unregister_device(pci_dev);
>          return rc;
>  +    }
>
>      /* rom loading */
>      if (pci_dev->romfile == NULL && info->romfile != NULL)
>
>
>

Re: [Qemu-devel] [PATCH] pci: cleanly backout of pci_qdev_init()

[Alex Williamson]

On Tue, 2010-05-11 at 21:17 +0300, Blue Swirl wrote:
> On 5/10/10, Alex Williamson <alex.williamson@redhat.com> wrote:
> >
> >   hw/pci.c |   17 ++++++++++++-----
> >   1 files changed, 12 insertions(+), 5 deletions(-)
> >
> >  diff --git a/hw/pci.c b/hw/pci.c
> >  index f167436..3d3560e 100644
> >  --- a/hw/pci.c
> >  +++ b/hw/pci.c
> >  @@ -625,6 +625,14 @@ static PCIDevice *do_pci_register_device(PCIDevice *pci_dev, PCIBus *bus,
> >      return pci_dev;
> >   }
> >
> >  +static void do_pci_unregister_device(PCIDevice *pci_dev)
> >  +{
> >  +    qemu_free_irqs(pci_dev->irq);
> >  +    pci_dev->bus->devices[pci_dev->devfn] = NULL;
> >  +    pci_config_free(pci_dev);
> >  +    return;
> 
> Isn't this 'return' useless?

Yeah, I'll remove it.

Alex