Commit abed886e authored by Paolo Bonzini's avatar Paolo Bonzini Committed by Andreas Färber
Browse files

qdev: Free QemuOpts when the QOM path goes away 



Otherwise there is a race where the DEVICE_DELETED event has been sent but
attempts to reuse the ID will fail.

Note that similar races exist for other QemuOpts, which this patch
does not attempt to fix.

For example, if the device is a block device, then unplugging it also
deletes its backend.  However, this backend's get deleted in
drive_info_del(), which is only called when properties are
destroyed.  Just like device_finalize(), drive_info_del() is called
some time after DEVICE_DELETED is sent.  A separate patch series has
been sent to plug this other bug.  Character devices also have yet to
be fixed.

Reported-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Reviewed-by: default avatarMarkus Armbruster <armbru@redhat.com>
Signed-off-by: default avatarAndreas Färber <afaerber@suse.de>
parent 7746abd8

hw/core/qdev.c

+3 −1
Original line number Diff line number Diff line
@@ -1206,7 +1206,6 @@ static void device_finalize(Object *obj) 
    NamedGPIOList *ngl, *next;



    DeviceState *dev = DEVICE(obj);

    qemu_opts_del(dev->opts);



    QLIST_FOREACH_SAFE(ngl, &dev->gpios, node, next) {

        QLIST_REMOVE(ngl, node);
@@ -1254,6 +1253,9 @@ static void device_unparent(Object *obj) 
        qapi_event_send_device_deleted(!!dev->id, dev->id, path, &error_abort);

        g_free(path);

    }



    qemu_opts_del(dev->opts);

    dev->opts = NULL;

}



static void device_class_init(ObjectClass *class, void *data)