Re: [PATCH] qom-hmp-cmds: fix a memleak in hmp_qom_get

[Pan Nengyuan]

On 6/3/2020 2:51 PM, Philippe Mathieu-Daudé wrote:
> Hi Pan,
> 
> On 6/3/20 9:03 AM, Pan Nengyuan wrote:
>> 'obj' forgot to free at the end of hmp_qom_get(). Fix that.
>>
>> The leak stack:
>> Direct leak of 40 byte(s) in 1 object(s) allocated from:
>>     #0 0x7f4e3a779ae8 in __interceptor_malloc (/lib64/libasan.so.5+0xefae8)
>>     #1 0x7f4e398f91d5 in g_malloc (/lib64/libglib-2.0.so.0+0x531d5)
>>     #2 0x55c9fd9a3999 in qstring_from_substr 
>> /build/qemu/src/qobject/qstring.c:45
>>     #3 0x55c9fd894bd3 in qobject_output_type_str 
>> /build/qemu/src/qapi/qobject-output-visitor.c:175
>>     #4 0x55c9fd894bd3 in qobject_output_type_str 
>> /build/qemu/src/qapi/qobject-output-visitor.c:168
>>     #5 0x55c9fd88b34d in visit_type_str 
>> /build/qemu/src/qapi/qapi-visit-core.c:308
>>     #6 0x55c9fd59aa6b in property_get_str /build/qemu/src/qom/object.c:2064
>>     #7 0x55c9fd5adb8a in object_property_get_qobject 
>> /build/qemu/src/qom/qom-qobject.c:38
>>     #8 0x55c9fd4a029d in hmp_qom_get /build/qemu/src/qom/qom-hmp-cmds.c:66
>>
>> Fixes: 89cf4fe34f4
> 
> When you fix a bug in a specific commit, please Cc the commit author and
> the reviewers, so they have a chance to 1/ review your fix and 2/ learn
> from their mistake.

Ok, I will do next time.

> 
>> Reported-by: Euler Robot <euler.robot@huawei.com>
>> Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com>
>> ---
>>  qom/qom-hmp-cmds.c | 1 +
>>  1 file changed, 1 insertion(+)
>>
>> diff --git a/qom/qom-hmp-cmds.c b/qom/qom-hmp-cmds.c
>> index f704b6949a..3d2a23292d 100644
>> --- a/qom/qom-hmp-cmds.c
>> +++ b/qom/qom-hmp-cmds.c
>> @@ -71,6 +71,7 @@ void hmp_qom_get(Monitor *mon, const QDict *qdict)
>>          qobject_unref(str);
>>      }
>>  
>> +    qobject_unref(obj);
> 
> The object_resolve_path() documentation is not clear about that...
> Can we get the documentation clarified?

I'm not sure why is object_resolve_path().
In this case, 'obj' is returned from object_property_get_qobject() in 
qmp_qom_get().
Do you mean document object_property_get_qobject() to make it more clear?
Like:
  - The returned object has a reference count of 1, and will be freed when the 
last reference is dropped.

Thanks.

> 
>>      hmp_handle_error(mon, err);
>>  }
>>  
>>
>