Flash devices created in virt_initfn() via qdev_new() hold an extra
reference that is only dropped on sysbus_realize_and_unref(). When the
machine is destroyed before realization, the flash objects leak. Also,
the oem_id and oem_table_id strings from g_strndup() are never freed.
Fixes: 445c9c645 ("hw/loongarch/virt: Allow user to customize OEM ID and OEM
table ID")
Signed-off-by: Marc-André Lureau <[email protected]>
---
hw/loongarch/virt.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index f68ccdb12b7..6693dea647b 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -1566,6 +1566,19 @@ static void virt_class_init(ObjectClass *oc, const void
*data)
#define DEFINE_VIRT_MACHINE(major, minor) \
DEFINE_VIRT_MACHINE_VERSION(false, major, minor)
+static void virt_instance_finalize(Object *obj)
+{
+ LoongArchVirtMachineState *lvms = LOONGARCH_VIRT_MACHINE(obj);
+
+ for (int i = 0; i < ARRAY_SIZE(lvms->flash); i++) {
+ if (lvms->flash[i] && !qdev_is_realized(DEVICE(lvms->flash[i]))) {
+ object_unref(OBJECT(lvms->flash[i]));
+ }
+ }
+ g_free(lvms->oem_id);
+ g_free(lvms->oem_table_id);
+}
+
static const TypeInfo virt_machine_info = {
.name = TYPE_LOONGARCH_VIRT_MACHINE,
.parent = TYPE_MACHINE,
@@ -1573,6 +1586,7 @@ static const TypeInfo virt_machine_info = {
.instance_size = sizeof(LoongArchVirtMachineState),
.class_init = virt_class_init,
.instance_init = virt_initfn,
+ .instance_finalize = virt_instance_finalize,
.interfaces = (InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ }
--
2.54.0
