From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([208.118.235.92]:34721)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <paolo.bonzini@gmail.com>) id 1UF1ev-0008Jr-Ji
	for qemu-devel@nongnu.org; Mon, 11 Mar 2013 08:16:58 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <paolo.bonzini@gmail.com>) id 1UF1es-0008DP-2U
	for qemu-devel@nongnu.org; Mon, 11 Mar 2013 08:16:53 -0400
Received: from mail-qc0-x22d.google.com ([2607:f8b0:400d:c01::22d]:35843)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <paolo.bonzini@gmail.com>) id 1UF1er-0008DC-TG
	for qemu-devel@nongnu.org; Mon, 11 Mar 2013 08:16:49 -0400
Received: by mail-qc0-f173.google.com with SMTP id b12so1457062qca.18
	for <qemu-devel@nongnu.org>; Mon, 11 Mar 2013 05:16:49 -0700 (PDT)
Sender: Paolo Bonzini <paolo.bonzini@gmail.com>
Message-ID: <513DCB2C.5030404@redhat.com>
Date: Mon, 11 Mar 2013 13:16:44 +0100
From: Paolo Bonzini <pbonzini@redhat.com>
MIME-Version: 1.0
References: <1489845274.730285.1361778940139.JavaMail.root@redhat.com>
	<512B1C35.3040500@de.ibm.com> <512B4073.6050100@redhat.com>
	<512B46C3.4030805@de.ibm.com>
	<B70C1A7A-6271-42E1-B35A-2F38D4AC4A5B@suse.de>
	<20130311130447.620e713d@gondolin>
In-Reply-To: <20130311130447.620e713d@gondolin>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH 1/3] virtio-ccw: remove qdev_unparent in
	unplug routing
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Cornelia Huck <cornelia.huck@de.ibm.com>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>, Jens Freimann <jfrei@linux.vnet.ibm.com>, Alexander Graf <agraf@suse.de>, =?ISO-8859-1?Q?Andreas_F=E4rber?= <afaerber@suse.de>, qemu-devel <qemu-devel@nongnu.org>

Il 11/03/2013 13:04, Cornelia Huck ha scritto:
> On Fri, 8 Mar 2013 21:11:13 +0100
> Alexander Graf <agraf@suse.de> wrote:
> 
>>
>> On 25.02.2013, at 12:10, Christian Borntraeger wrote:
>>
>>> On 25/02/13 11:44, Paolo Bonzini wrote:
>>>> Il 25/02/2013 09:09, Christian Borntraeger ha scritto:
>>>>> Hmm, the old sequence was 
>>>>>
>>>>>     object_unparent(OBJECT(dev));
>>>>>     qdev_free(dev) ---+
>>>>>                       |
>>>>>                       V
>>>>> ...
>>>>> 	     object_unparent(OBJECT(dev));  now the last reference is gone, object is freed
>>>>> 	     object_unref(OBJECT(dev));     now the reference of a deleted object becomes -1
>>>>> ...
>>>>>
>>>>> Isnt that a problem in itself that we modify a reference counter in an deleted object?
>>>>
>>>> The second object_unparent should do nothing.  So before you had:
>>>>
>>>>      object_unparent(OBJECT(dev));	    leaves refcount=1
>>>>      qdev_free(dev) ---+
>>>>                        |
>>>>                        V
>>>> 	     object_unparent(OBJECT(dev));  do nothing
>>>> 	     object_unref(OBJECT(dev));     refcount=0, object freed
>>>>
>>>> After the object_unref was removed you had:
>>>>
>>>>      object_unparent(OBJECT(dev));	    refcount=0, object freed
>>>>      qdev_free(dev) ---+
>>>>                        |
>>>>                        V
>>>> 	     object_unparent(OBJECT(dev));  dangling pointer!
>>>>
>>>
>>>
>>> Got it. Thanks
>>
>> So is the patch valid?
> 
> To my understanding, yes.

Yes, except that the "fixed a crash" part in the commit message is
probably no longer accurate.  No big deal. :)

Paolo