Each device has a reference through the BusChild. This reference was not accounted for, add it now.
Signed-off-by: Paolo Bonzini <pbonz...@redhat.com> --- hw/qdev.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hw/qdev.c b/hw/qdev.c index b473bd7..f88a8a4 100644 --- a/hw/qdev.c +++ b/hw/qdev.c @@ -64,7 +64,10 @@ static void bus_remove_child(BusState *bus, DeviceState *child) snprintf(name, sizeof(name), "child[%d]", kid->index); QTAILQ_REMOVE(&bus->children, kid, sibling); + + /* This gives back ownership of kid->child back to us. */ object_property_del(OBJECT(bus), name, NULL); + object_unref(OBJECT(kid->child)); g_free(kid); return; } @@ -82,9 +85,11 @@ static void bus_add_child(BusState *bus, DeviceState *child) kid->index = bus->max_index++; kid->child = child; + object_ref(OBJECT(kid->child)); QTAILQ_INSERT_HEAD(&bus->children, kid, sibling); + /* This transfers ownership of kid->child to the property. */ snprintf(name, sizeof(name), "child[%d]", kid->index); object_property_add_link(OBJECT(bus), name, object_get_typename(OBJECT(child)), -- 1.8.1