diff options
| author | Alex Williamson <alex.williamson@redhat.com> | 2015-02-04 11:45:32 -0700 |
|---|---|---|
| committer | Alex Williamson <alex.williamson@redhat.com> | 2015-02-04 11:45:32 -0700 |
| commit | 3a4dbe6aa934370a92372528c1255ee1504965ee (patch) | |
| tree | 1f48da04443a91ab6bb8b7d818a1b63cf1065956 /hw/vfio | |
| parent | 39cb514f02c7daf6378117e28be7a659a69e48b7 (diff) | |
| download | qemu-3a4dbe6aa934370a92372528c1255ee1504965ee.zip qemu-3a4dbe6aa934370a92372528c1255ee1504965ee.tar.gz qemu-3a4dbe6aa934370a92372528c1255ee1504965ee.tar.bz2 | |
vfio-pci: Fix missing unparent of dynamically allocated MemoryRegion
Commit d8d95814609e added explicit object_unparent() calls for
dynamically allocated MemoryRegions. The VFIOMSIXInfo structure also
contains such a MemoryRegion, covering the mmap'd region of a PCI BAR
above the MSI-X table. This structure is freed as part of the class
exit function and therefore also needs an explicit object_unparent().
Failing to do this results in random segfaults due to fields within
the structure, often the class pointer, being reclaimed and corrupted
by the time object_finalize_child_property() is called for the object.
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Cc: qemu-stable@nongnu.org # 2.2
Diffstat (limited to 'hw/vfio')
| -rw-r--r-- | hw/vfio/pci.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index 014a92c..29caabc 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -3065,6 +3065,7 @@ static void vfio_put_device(VFIOPCIDevice *vdev) { g_free(vdev->vbasedev.name); if (vdev->msix) { + object_unparent(OBJECT(&vdev->msix->mmap_mem)); g_free(vdev->msix); vdev->msix = NULL; } |