From patchwork Wed Jun 29 20:50:20 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kurz X-Patchwork-Id: 9206199 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 5C30760757 for ; Wed, 29 Jun 2016 20:55:21 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4265D28585 for ; Wed, 29 Jun 2016 20:55:21 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 334EB285EF; Wed, 29 Jun 2016 20:55:21 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id B319E28585 for ; Wed, 29 Jun 2016 20:55:20 +0000 (UTC) Received: from localhost ([::1]:45735 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bIMVz-0002tX-QM for patchwork-qemu-devel@patchwork.kernel.org; Wed, 29 Jun 2016 16:55:19 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:47578) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bIMRT-0007ue-1l for qemu-devel@nongnu.org; Wed, 29 Jun 2016 16:50:40 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bIMRM-00029T-Vn for qemu-devel@nongnu.org; Wed, 29 Jun 2016 16:50:37 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:23413) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bIMRM-00029N-Lw for qemu-devel@nongnu.org; Wed, 29 Jun 2016 16:50:32 -0400 Received: from pps.filterd (m0098394.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.11/8.16.0.11) with SMTP id u5TKhTpA143908 for ; Wed, 29 Jun 2016 16:50:32 -0400 Received: from e17.ny.us.ibm.com (e17.ny.us.ibm.com [129.33.205.207]) by mx0a-001b2d01.pphosted.com with ESMTP id 23uuhu71we-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Wed, 29 Jun 2016 16:50:31 -0400 Received: from localhost by e17.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 29 Jun 2016 16:50:30 -0400 Received: from d01dlp03.pok.ibm.com (9.56.250.168) by e17.ny.us.ibm.com (146.89.104.204) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Wed, 29 Jun 2016 16:50:28 -0400 X-IBM-Helo: d01dlp03.pok.ibm.com X-IBM-MailFrom: groug@kaod.org Received: from b01cxnp22033.gho.pok.ibm.com (b01cxnp22033.gho.pok.ibm.com [9.57.198.23]) by d01dlp03.pok.ibm.com (Postfix) with ESMTP id 75CB2C90043; Wed, 29 Jun 2016 16:50:18 -0400 (EDT) Received: from b01ledav005.gho.pok.ibm.com (b01ledav005.gho.pok.ibm.com [9.57.199.110]) by b01cxnp22033.gho.pok.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id u5TKoRnb47448110; Wed, 29 Jun 2016 20:50:27 GMT Received: from b01ledav005.gho.pok.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7E213AE04E; Wed, 29 Jun 2016 16:50:27 -0400 (EDT) Received: from bahia.lan (unknown [9.164.167.94]) by b01ledav005.gho.pok.ibm.com (Postfix) with ESMTP id B58AAAE052; Wed, 29 Jun 2016 16:50:23 -0400 (EDT) From: Greg Kurz To: David Gibson Date: Wed, 29 Jun 2016 22:50:20 +0200 In-Reply-To: <146723340662.9665.6413150884317978000.stgit@bahia.lan> References: <146723340662.9665.6413150884317978000.stgit@bahia.lan> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Content-Scanned: Fidelis XPS MAILER x-cbid: 16062920-0040-0000-0000-000000B0D675 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 16062920-0041-0000-0000-0000048AEB43 Message-Id: <146723342014.9665.3613446436074803191.stgit@bahia.lan> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-06-29_11:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=2 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1606290192 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] X-Received-From: 148.163.156.1 Subject: [Qemu-devel] [PATCH 1/8] spapr: drop reference on child object during core realization X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Peter Crosthwaite , qemu-devel@nongnu.org, Alexander Graf , qemu-ppc@nongnu.org, Cedric Le Goater , bharata@linux.vnet.ibm.com, Scott Wood , Paolo Bonzini , Richard Henderson Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP When a core is being realized, we create a child object for each thread of the core. The child is first initialized with object_initialize() which sets its ref count to 1, and then added to the core with object_property_add_child() which bumps the ref count to 2. When the core gets released, object_unparent() decreases the ref count to 1, and we g_free() the object: we hence loose the reference on an unfinalized object. This is likely to cause random crashes. Let's drop the extra reference as soon as we don't need it, after the thread is added to the core. Signed-off-by: Greg Kurz Reviewed-by: Bharata B Rao --- hw/ppc/spapr_cpu_core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c index 2aa0dc523374..789eb2e6f206 100644 --- a/hw/ppc/spapr_cpu_core.c +++ b/hw/ppc/spapr_cpu_core.c @@ -299,8 +299,9 @@ static void spapr_cpu_core_realize(DeviceState *dev, Error **errp) object_property_add_child(OBJECT(sc), id, obj, &local_err); if (local_err) { goto err; } + object_unref(obj); } object_child_foreach(OBJECT(dev), spapr_cpu_core_realize_child, &local_err); if (local_err) { goto err;