On Fri, Jul 13, 2018 at 10:27:33AM +0200, Thomas Huth wrote:
> There is a memory management problem when introspecting the a15mpcore_priv
> device. It can be seen with valgrind when running QEMU like this:
>
> echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \
> "'arguments':{'typename':'a15mpcore_priv'}}"\
> "{'execute': 'human-monitor-command', " \
> "'arguments': {'command-line': 'info qtree'}}" | \
> valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp
> stdio
> {"QMP": {"version": {"qemu": {"micro": 50, "minor": 12, "major": 2},
> "package": "build-all"}, "capabilities": []}}
> {"return": {}}
> {"return": [{"name": "num-cpu", "type": "uint32"}, {"name": "num-irq",
> "type": "uint32"}, {"name": "a15mp-priv-container[0]", "type":
> "child<qemu:memory-region>"}]}
> ==24978== Invalid read of size 8
> ==24978== at 0x618EBA: qdev_print (qdev-monitor.c:686)
> ==24978== by 0x618EBA: qbus_print (qdev-monitor.c:719)
> [...]
>
> Use the new sysbus_init_child_obj() function to make sure that we get
> the reference counting of the child objects right.
>
> Signed-off-by: Thomas Huth <th...@redhat.com>
> ---
> hw/cpu/a15mpcore.c | 8 +++-----
> 1 file changed, 3 insertions(+), 5 deletions(-)
>
> diff --git a/hw/cpu/a15mpcore.c b/hw/cpu/a15mpcore.c
> index bc05152..43c1079 100644
> --- a/hw/cpu/a15mpcore.c
> +++ b/hw/cpu/a15mpcore.c
> @@ -35,15 +35,13 @@ static void a15mp_priv_initfn(Object *obj)
> {
> SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
> A15MPPrivState *s = A15MPCORE_PRIV(obj);
> - DeviceState *gicdev;
>
> memory_region_init(&s->container, obj, "a15mp-priv-container", 0x8000);
> sysbus_init_mmio(sbd, &s->container);
>
> - object_initialize(&s->gic, sizeof(s->gic), gic_class_name());
> - gicdev = DEVICE(&s->gic);
> - qdev_set_parent_bus(gicdev, sysbus_get_default());
> - qdev_prop_set_uint32(gicdev, "revision", 2);
> + sysbus_init_child_obj(obj, "gic", &s->gic, sizeof(s->gic),
> + gic_class_name());
> + qdev_prop_set_uint32(DEVICE(&s->gic), "revision", 2);
I assume qdev_set_parent_bus() won't trigger any code that looks
at "revision", so the prop_set/set_parent_bus ordering change
won't matter.
Reviewed-by: Eduardo Habkost <ehabk...@redhat.com>
--
Eduardo
