diff options
| author | Alex Williamson <alex.williamson@redhat.com> | 2015-02-04 11:45:32 -0700 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2015-02-23 18:04:34 -0600 |
| commit | 4d49de6b6f9b45446dd31990a177b13953f2e842 (patch) | |
| tree | 06685b605660f40cba73c1bd6396cac8665f3888 | |
| parent | 3750d2588e8d8d204820fef4ce95d7c271bafd3f (diff) | |
| download | qemu-4d49de6b6f9b45446dd31990a177b13953f2e842.tar.gz | |
vfio-pci: Fix missing unparent of dynamically allocated MemoryRegion
Commit d8d95814609e added explicit object_unparent() calls for
dynamically allocated MemoryRegions. The VFIOMSIXInfo structure also
contains such a MemoryRegion, covering the mmap'd region of a PCI BAR
above the MSI-X table. This structure is freed as part of the class
exit function and therefore also needs an explicit object_unparent().
Failing to do this results in random segfaults due to fields within
the structure, often the class pointer, being reclaimed and corrupted
by the time object_finalize_child_property() is called for the object.
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Cc: qemu-stable@nongnu.org # 2.2
(cherry picked from commit 3a4dbe6aa934370a92372528c1255ee1504965ee)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
| -rw-r--r-- | hw/misc/vfio.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/hw/misc/vfio.c b/hw/misc/vfio.c index fd318a122d..7bff62c2c3 100644 --- a/hw/misc/vfio.c +++ b/hw/misc/vfio.c @@ -4049,6 +4049,7 @@ static void vfio_put_device(VFIODevice *vdev) DPRINTF("vfio_put_device: close vdev->fd\n"); close(vdev->fd); if (vdev->msix) { + object_unparent(OBJECT(&vdev->msix->mmap_mem)); g_free(vdev->msix); vdev->msix = NULL; } |