Commit bce410a3 authored by Igor Mammedov's avatar Igor Mammedov Committed by Paolo Bonzini
Browse files

ivshmem: fix memory backend leak 



object_new() returns a new backend with refcount == 1 and
then later object_property_add_child() increases refcount to 2
So when ivshmem is destroyed, the backend it has created isn't
destroyed along with it as children cleanup will bring
backend's refcount only to 1, which leaks backend including
resources it is using.

Drop the original reference from object_new() once backend
is attached to its parent.

Signed-off-by: default avatarIgor Mammedov <imammedo@redhat.com>
Message-Id: <1541069086-167036-1-git-send-email-imammedo@redhat.com>
Reviewed-by: default avatarMarc-André Lureau <marcandre.lureau@redhat.com>
Fixes: 5503e285
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent d4715481

hw/misc/ivshmem.c

+1 −0
Original line number Diff line number Diff line
@@ -1279,6 +1279,7 @@ static void desugar_shm(IVShmemState *s) 
    object_property_set_bool(obj, true, "share", &error_abort);

    object_property_add_child(OBJECT(s), "internal-shm-backend", obj,

                              &error_abort);

    object_unref(obj);

    user_creatable_complete(obj, &error_abort);

    s->hostmem = MEMORY_BACKEND(obj);

}