From patchwork Wed Nov 5 14:29:35 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marcel Apfelbaum X-Patchwork-Id: 407000 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 930B3140098 for ; Thu, 6 Nov 2014 01:31:13 +1100 (AEDT) Received: from localhost ([::1]:46754 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Xm1c7-0002CB-0n for incoming@patchwork.ozlabs.org; Wed, 05 Nov 2014 09:31:11 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:35663) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Xm1bl-0001vb-B9 for qemu-devel@nongnu.org; Wed, 05 Nov 2014 09:30:55 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Xm1be-0005sM-Bg for qemu-devel@nongnu.org; Wed, 05 Nov 2014 09:30:49 -0500 Received: from mx1.redhat.com ([209.132.183.28]:46716) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Xm1be-0005sA-1M for qemu-devel@nongnu.org; Wed, 05 Nov 2014 09:30:42 -0500 Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id sA5EUec8010521 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL) for ; Wed, 5 Nov 2014 09:30:40 -0500 Received: from localhost.localdomain.com (vpn1-4-20.ams2.redhat.com [10.36.4.20]) by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id sA5EUaqn015082; Wed, 5 Nov 2014 09:30:38 -0500 From: Marcel Apfelbaum To: qemu-devel@nongnu.org Date: Wed, 5 Nov 2014 16:29:35 +0200 Message-Id: <1415197775-18506-1-git-send-email-marcel.a@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.22 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 209.132.183.28 Cc: marcel@redhat.com, mst@redhat.com Subject: [Qemu-devel] [PATCH] hw/pci: fix crash on shpc error flow X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org If the pci bridge enters in error flow as part of init process it will only delete the shpc mmio subregion but not remove it from the properties list, resulting in segmentation fault when the bridge runs the exit function. Example: add a pci bridge without specifing the chassis number: ... -device pci-bridge,id=p1 Result: (qemu) qemu-system-x86_64: -device pci-bridge,id=p1: Bridge chassis not specified. Each bridge is required to be assigned a unique chassis id > 0. qemu-system-x86_64: -device pci-bridge,id=p1: Device initialization failed. Segmentation fault (core dumped) if (child->class->unparent) { #0 0x00005555558d629b in object_finalize_child_property (obj=0x555556d2e830, name=0x555556d30630 "shpc-mmio[0]", opaque=0x555556a42fc8) at qom/object.c:1078 #1 0x00005555558d4b1f in object_property_del_all (obj=0x555556d2e830) at qom/object.c:367 #2 0x00005555558d4ca1 in object_finalize (data=0x555556d2e830) at qom/object.c:412 #3 0x00005555558d55a1 in object_unref (obj=0x555556d2e830) at qom/object.c:720 #4 0x000055555572c907 in qdev_device_add (opts=0x5555563544f0) at qdev-monitor.c:566 #5 0x0000555555744f16 in device_init_func (opts=0x5555563544f0, opaque=0x0) at vl.c:2213 #6 0x00005555559cf5f0 in qemu_opts_foreach (list=0x555555e0f8e0 , func=0x555555744efa , opaque=0x0, abort_on_failure=1) at util/qemu-option.c:1057 #7 0x000055555574a11b in main (argc=16, argv=0x7fffffffdde8, envp=0x7fffffffde70) at vl.c:423 Unparent the shpc mmio region as part of shpc cleanup. Signed-off-by: Marcel Apfelbaum Reviewed-by: Amos Kong --- hw/pci/shpc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/pci/shpc.c b/hw/pci/shpc.c index 65b2f51..2e887d7 100644 --- a/hw/pci/shpc.c +++ b/hw/pci/shpc.c @@ -662,6 +662,7 @@ void shpc_cleanup(PCIDevice *d, MemoryRegion *bar) SHPCDevice *shpc = d->shpc; d->cap_present &= ~QEMU_PCI_CAP_SHPC; memory_region_del_subregion(bar, &shpc->mmio); + object_unparent(OBJECT(&shpc->mmio)); /* TODO: cleanup config space changes? */ g_free(shpc->config); g_free(shpc->cmask);