[Qemu-devel] [PATCH v2 3/6] s390x/pci: Always delete and free the release_timer

David Hildenbrand posted 6 patches 6 years, 9 months ago
Maintainers: Collin Walling <walling@linux.ibm.com>, Halil Pasic <pasic@linux.ibm.com>, Richard Henderson <rth@twiddle.net>, Christian Borntraeger <borntraeger@de.ibm.com>, Cornelia Huck <cohuck@redhat.com>, David Hildenbrand <david@redhat.com>
There is a newer version of this series
[Qemu-devel] [PATCH v2 3/6] s390x/pci: Always delete and free the release_timer
Posted by David Hildenbrand 6 years, 9 months ago
We should always get rid of it. I don't see a reason to keep the timer
alive if the devices are going away. This looks like a memory leak.

(hmp) device_add virtio-mouse-pci,id=test
(hmp) device_del test
-> guest notified, timer pending.
-> guest does not react for some reason (e.g. crash)
-> s390_pcihost_timer_cb(). Timer not pending anymore. qmp_unplug().

-> Device deleted. Timer expired (not pending) but not freed.

Signed-off-by: David Hildenbrand <david@redhat.com>
---
 hw/s390x/s390-pci-bus.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/s390x/s390-pci-bus.c b/hw/s390x/s390-pci-bus.c
index 1775388524..59325cae3b 100644
--- a/hw/s390x/s390-pci-bus.c
+++ b/hw/s390x/s390-pci-bus.c
@@ -982,7 +982,7 @@ static void s390_pcihost_unplug(HotplugHandler *hotplug_dev, DeviceState *dev,
         return;
     }
 
-    if (pbdev->release_timer && timer_pending(pbdev->release_timer)) {
+    if (pbdev->release_timer) {
         timer_del(pbdev->release_timer);
         timer_free(pbdev->release_timer);
         pbdev->release_timer = NULL;
-- 
2.17.2


Re: [Qemu-devel] [PATCH v2 3/6] s390x/pci: Always delete and free the release_timer
Posted by Collin Walling 6 years, 9 months ago
On 1/14/19 5:31 AM, David Hildenbrand wrote:
> We should always get rid of it. I don't see a reason to keep the timer
> alive if the devices are going away. This looks like a memory leak.
> 
> (hmp) device_add virtio-mouse-pci,id=test
> (hmp) device_del test
> -> guest notified, timer pending.
> -> guest does not react for some reason (e.g. crash)
> -> s390_pcihost_timer_cb(). Timer not pending anymore. qmp_unplug().
> 
> -> Device deleted. Timer expired (not pending) but not freed.
> 
> Signed-off-by: David Hildenbrand <david@redhat.com>
> ---
>   hw/s390x/s390-pci-bus.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/hw/s390x/s390-pci-bus.c b/hw/s390x/s390-pci-bus.c
> index 1775388524..59325cae3b 100644
> --- a/hw/s390x/s390-pci-bus.c
> +++ b/hw/s390x/s390-pci-bus.c
> @@ -982,7 +982,7 @@ static void s390_pcihost_unplug(HotplugHandler *hotplug_dev, DeviceState *dev,
>           return;
>       }
>   
> -    if (pbdev->release_timer && timer_pending(pbdev->release_timer)) {
> +    if (pbdev->release_timer) {
>           timer_del(pbdev->release_timer);
>           timer_free(pbdev->release_timer);
>           pbdev->release_timer = NULL;
> 

Looks like the only time we would hit this is when the device is already 
in standby (i.e. not configured). So this makes sense to me.

Reviewed-by: Collin Walling <walling@linux.ibm.com>