From: Marc-André Lureau <[email protected]>
Flash devices are created with qdev_new() in instance_init and added as
children, but the initial reference from qdev_new() is only dropped by
sysbus_realize_and_unref() during machine init. When the machine object
is destroyed before realization (e.g. during qtest device introspection),
the flash devices leak.
Fixes: e9fdf453240e ("hw/arm: Add arm SBSA reference machine, devices part")
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Signed-off-by: Marc-André Lureau <[email protected]>
---
hw/arm/sbsa-ref.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index 52c35e10c2d..484b90053e8 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -892,6 +892,17 @@ static void sbsa_ref_instance_init(Object *obj)
sbsa_flash_create(sms);
}
+static void sbsa_ref_instance_finalize(Object *obj)
+{
+ SBSAMachineState *sms = SBSA_MACHINE(obj);
+
+ for (int i = 0; i < ARRAY_SIZE(sms->flash); i++) {
+ if (sms->flash[i] && !qdev_is_realized(DEVICE(sms->flash[i]))) {
+ object_unref(OBJECT(sms->flash[i]));
+ }
+ }
+}
+
static void sbsa_ref_class_init(ObjectClass *oc, const void *data)
{
MachineClass *mc = MACHINE_CLASS(oc);
@@ -930,6 +941,7 @@ static const TypeInfo sbsa_ref_info = {
.name = TYPE_SBSA_MACHINE,
.parent = TYPE_MACHINE,
.instance_init = sbsa_ref_instance_init,
+ .instance_finalize = sbsa_ref_instance_finalize,
.class_init = sbsa_ref_class_init,
.instance_size = sizeof(SBSAMachineState),
.interfaces = aarch64_machine_interfaces,
--
2.54.0
