[Qemu-devel] Possible reference leak in device_set_realized(...)

[Ilya Lesokhin]

Hi,

I’m working on SRIOV support for VFIO and I’m suffering from a reference leak.

I’m using Knut Omang’s patches for SRIOV[1].

 

When the VF’s are enabled I call

pci_create(…) and then object_property_set_bool(OBJECT(&dev->qdev), true, "realized", &local_err);

and when the VF’s are disabled I call

object_property_set_bool(OBJECT(&dev->exp.sriov_pf.vf[i]->qdev), false, "realized", &local_err);

Following that sequence of events, the VFIO instance_finalize function is never called.

 

It seems that the leaked reference is created by object_property_add_child(…) which called by device_set_realized(…)

When the realized property is set.

Looking at the code of device_set_realized(…) I don’t see anything that might remove the reference taken by

object_property_add_child(…), when realized is set to false.

 

Does anyone know how this reference is supposed to be released?

Is object_finalize_child_property(…) supposed to be triggered somehow?

 

I was able to overcome this issue by calling object_unparent on my device but I’m not sure that the correct way of fixing it.

 

Thanks,

Ilya

 

[1] https://github.com/knuto/qemu/tree/sriov_patches_v6