Per CXL r4.0 Section 8.2.9.4, "Background commands do not continue to execute across Conventional Resets." If a sanitize or media operation is in progress when the device is reset, the background timer is already cancelled and freed via cxl_destroy_cci(), but the per-operation state (media_op_sanitize) is heap-allocated separately and would otherwise be leaked.
Free it unconditionally at the end of the reset hold phase. The timer that advances the operation lives in the CCI that was just destroyed and re-initialized, so the operation can never complete after a reset of any type; preserving the heap state across reset has no benefit and would leak it the next time media_op_sanitize is assigned. Note that Section 8.2.10.9.5.1 additionally requires a device whose Sanitize was interrupted by reset to remain in the Media Disabled state until a successful Sanitize completes. That latch is not modelled here (reset re-enables media via memdev_reg_init_common()) and is left for future work; this patch only addresses the resource leak. Signed-off-by: Junjie Cao <[email protected]> --- hw/mem/cxl_type3.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c index b842e71c66..a5e6df3033 100644 --- a/hw/mem/cxl_type3.c +++ b/hw/mem/cxl_type3.c @@ -1361,6 +1361,16 @@ static void ct3d_reset_hold(Object *obj, ResetType type) } cxl_initialize_t3_ld_cci(&ct3d->ld0_cci, DEVICE(ct3d), DEVICE(ct3d), 512); /* Max payload made up */ + + /* + * Free any in-flight sanitize state unconditionally. The background + * timer that would advance it lives in the CCI just torn down and + * re-initialized above, so the operation can never complete after this + * point regardless of the reset type; keeping the heap state would only + * leak it on the next allocation. + */ + g_free(ct3d->media_op_sanitize); + ct3d->media_op_sanitize = NULL; } static const Property ct3_props[] = { -- 2.43.0
