diff mbox series

[PULL,07/30] hw/arm/virt: fix cpu object reference leak

Message ID 1488218699-31035-8-git-send-email-peter.maydell@linaro.org
State Accepted
Commit dbb74759fae6f521709e16e19cbb7d6fb2307700
Headers show
Series target-arm queue | expand

Commit Message

Peter Maydell Feb. 27, 2017, 6:04 p.m. UTC 
From: Igor Mammedov <imammedo@redhat.com>


object_new(FOO) returns an object with ref_cnt == 1
and following
  object_property_set_bool(cpuobj, true, "realized", NULL)
set parent of cpuobj to '/machine/unattached' which makes
ref_cnt == 2.

Since machvirt_init() doesn't take ownership of cpuobj
returned by object_new() it should explicitly drop
reference to cpuobj when dangling pointer is about to
go out of scope like it's done pc_new_cpu() to avoid
object leak.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>

Message-id: 1487253461-269218-1-git-send-email-imammedo@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---
 hw/arm/virt.c | 1 +
 1 file changed, 1 insertion(+)

-- 
2.7.4
diff mbox series

Patch

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index f3440f2..0c270b8 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -1378,6 +1378,7 @@  static void machvirt_init(MachineState *machine)
         }
 
         object_property_set_bool(cpuobj, true, "realized", NULL);
+        object_unref(cpuobj);
     }
     fdt_add_timer_nodes(vms);
     fdt_add_cpu_nodes(vms);