From: Paolo Bonzini <pbonz...@redhat.com> The regions are destroyed and recreated on configuration space accesses. We need to destroy them before the containing PCIBridgeWindows object is freed.
Reported-by: Gonglei <arei.gong...@huawei.com> Reported-by: Knut Omang <knut.om...@oracle.com> Signed-off-by: Paolo Bonzini <pbonz...@redhat.com> Reviewed-by: Michael S. Tsirkin <m...@redhat.com> Signed-off-by: Michael S. Tsirkin <m...@redhat.com> --- hw/pci/pci_bridge.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/hw/pci/pci_bridge.c b/hw/pci/pci_bridge.c index 1307265..40c97b1 100644 --- a/hw/pci/pci_bridge.c +++ b/hw/pci/pci_bridge.c @@ -219,6 +219,12 @@ static void pci_bridge_region_del(PCIBridge *br, PCIBridgeWindows *w) static void pci_bridge_region_cleanup(PCIBridge *br, PCIBridgeWindows *w) { + object_unparent(OBJECT(&w->alias_io)); + object_unparent(OBJECT(&w->alias_mem)); + object_unparent(OBJECT(&w->alias_pref_mem)); + object_unparent(OBJECT(&w->alias_vga[QEMU_PCI_VGA_IO_LO])); + object_unparent(OBJECT(&w->alias_vga[QEMU_PCI_VGA_IO_HI])); + object_unparent(OBJECT(&w->alias_vga[QEMU_PCI_VGA_MEM])); g_free(w); } -- MST