This patch fix memleaks when we call tests/qtest/cpu-plug-test on s390x. The leak stack is as follow:
Direct leak of 48 byte(s) in 1 object(s) allocated from:
#0 0x7fb43c7cd970 in __interceptor_calloc (/lib64/libasan.so.5+0xef970)
#1 0x7fb43be2149d in g_malloc0 (/lib64/libglib-2.0.so.0+0x5249d)
#2 0x558ba96da716 in timer_new_full /mnt/sdb/qemu-new/qemu/include/qemu/timer.h:530
#3 0x558ba96da716 in timer_new /mnt/sdb/qemu-new/qemu/include/qemu/timer.h:551
#4 0x558ba96da716 in timer_new_ns /mnt/sdb/qemu-new/qemu/include/qemu/timer.h:569
#5 0x558ba96da716 in s390_cpu_initfn /mnt/sdb/qemu-new/qemu/target/s390x/cpu.c:285
#6 0x558ba9c969ab in object_init_with_type /mnt/sdb/qemu-new/qemu/qom/object.c:372
#7 0x558ba9c9eb5f in object_initialize_with_type /mnt/sdb/qemu-new/qemu/qom/object.c:516
#8 0x558ba9c9f053 in object_new_with_type /mnt/sdb/qemu-new/qemu/qom/object.c:684
#9 0x558ba967ede6 in s390x_new_cpu /mnt/sdb/qemu-new/qemu/hw/s390x/s390-virtio-ccw.c:64
#10 0x558ba99764b3 in hmp_cpu_add /mnt/sdb/qemu-new/qemu/hw/core/machine-hmp-cmds.c:57
#11 0x558ba9b1c27f in handle_hmp_command /mnt/sdb/qemu-new/qemu/monitor/hmp.c:1082
#12 0x558ba96c1b02 in qmp_human_monitor_command /mnt/sdb/qemu-new/qemu/monitor/misc.c:142
Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com>
---
Cc: Richard Henderson <rth@twiddle.net>
Cc: David Hildenbrand <david@redhat.com>
Cc: Cornelia Huck <cohuck@redhat.com>
Cc: qemu-s390x@nongnu.org
---
v2->v1:
- Similarly to other cleanups, move timer_new into realize(Suggested by Philippe Mathieu-Daudé)
v3->v2:
- Aslo do the timer_free in unrealize, it seems balanced.
v4->v3:
- Aslo do timer_free on the error path in realize() and fix some coding style.
- Use device_class_set_parent_unrealize to declare unrealize.
---
target/s390x/cpu-qom.h | 1 +
target/s390x/cpu.c | 41 +++++++++++++++++++++++++++++++++++++----
2 files changed, 38 insertions(+), 4 deletions(-)
diff --git a/target/s390x/cpu-qom.h b/target/s390x/cpu-qom.h
index dbe5346ec9..af9ffed0d8 100644
--- a/target/s390x/cpu-qom.h
+++ b/target/s390x/cpu-qom.h
@@ -61,6 +61,7 @@ typedef struct S390CPUClass {
const char *desc;
DeviceRealize parent_realize;
+ DeviceUnrealize parent_unrealize;
void (*parent_reset)(CPUState *cpu);
void (*load_normal)(CPUState *cpu);
void (*reset)(CPUState *cpu, cpu_reset_type type);
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index cf84d307c6..80b987ff1b 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -182,6 +182,12 @@ static void s390_cpu_realizefn(DeviceState *dev, Error **errp)
#if !defined(CONFIG_USER_ONLY)
MachineState *ms = MACHINE(qdev_get_machine());
unsigned int max_cpus = ms->smp.max_cpus;
+
+ cpu->env.tod_timer =
+ timer_new_ns(QEMU_CLOCK_VIRTUAL, s390x_tod_timer, cpu);
+ cpu->env.cpu_timer =
+ timer_new_ns(QEMU_CLOCK_VIRTUAL, s390x_cpu_timer, cpu);
+
if (cpu->env.core_id >= max_cpus) {
error_setg(&err, "Unable to add CPU with core-id: %" PRIu32
", maximum core-id: %d", cpu->env.core_id,
@@ -224,9 +230,38 @@ static void s390_cpu_realizefn(DeviceState *dev, Error **errp)
scc->parent_realize(dev, &err);
out:
+ if (cpu->env.tod_timer) {
+ timer_del(cpu->env.tod_timer);
+ }
+ if (cpu->env.cpu_timer) {
+ timer_del(cpu->env.cpu_timer);
+ }
+ timer_free(cpu->env.tod_timer);
+ timer_free(cpu->env.cpu_timer);
error_propagate(errp, err);
}
+static void s390_cpu_unrealizefn(DeviceState *dev, Error **errp)
+{
+ S390CPUClass *scc = S390_CPU_GET_CLASS(dev);
+ Error *err = NULL;
+
+#if !defined(CONFIG_USER_ONLY)
+ S390CPU *cpu = S390_CPU(dev);
+
+ timer_del(cpu->env.tod_timer);
+ timer_del(cpu->env.cpu_timer);
+ timer_free(cpu->env.tod_timer);
+ timer_free(cpu->env.cpu_timer);
+#endif
+
+ scc->parent_unrealize(dev, &err);
+ if (err != NULL) {
+ error_propagate(errp, err);
+ return;
+ }
+}
+
static GuestPanicInformation *s390_cpu_get_crash_info(CPUState *cs)
{
GuestPanicInformation *panic_info;
@@ -279,10 +314,6 @@ static void s390_cpu_initfn(Object *obj)
s390_cpu_get_crash_info_qom, NULL, NULL, NULL, NULL);
s390_cpu_model_register_props(obj);
#if !defined(CONFIG_USER_ONLY)
- cpu->env.tod_timer =
- timer_new_ns(QEMU_CLOCK_VIRTUAL, s390x_tod_timer, cpu);
- cpu->env.cpu_timer =
- timer_new_ns(QEMU_CLOCK_VIRTUAL, s390x_cpu_timer, cpu);
s390_cpu_set_state(S390_CPU_STATE_STOPPED, cpu);
#endif
}
@@ -453,6 +484,8 @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
device_class_set_parent_realize(dc, s390_cpu_realizefn,
&scc->parent_realize);
+ device_class_set_parent_unrealize(dc, s390_cpu_unrealizefn,
+ &scc->parent_unrealize);
device_class_set_props(dc, s390x_cpu_properties);
dc->user_creatable = true;
--
2.18.2
> #if !defined(CONFIG_USER_ONLY)
> MachineState *ms = MACHINE(qdev_get_machine());
> unsigned int max_cpus = ms->smp.max_cpus;
> +
> + cpu->env.tod_timer =
> + timer_new_ns(QEMU_CLOCK_VIRTUAL, s390x_tod_timer, cpu);
> + cpu->env.cpu_timer =
> + timer_new_ns(QEMU_CLOCK_VIRTUAL, s390x_cpu_timer, cpu);
> +
> if (cpu->env.core_id >= max_cpus) {
> error_setg(&err, "Unable to add CPU with core-id: %" PRIu32
> ", maximum core-id: %d", cpu->env.core_id,
> @@ -224,9 +230,38 @@ static void s390_cpu_realizefn(DeviceState *dev, Error **errp)
>
> scc->parent_realize(dev, &err);
> out:
> + if (cpu->env.tod_timer) {
> + timer_del(cpu->env.tod_timer);
> + }
> + if (cpu->env.cpu_timer) {
> + timer_del(cpu->env.cpu_timer);
> + }
> + timer_free(cpu->env.tod_timer);
> + timer_free(cpu->env.cpu_timer);
timer_free() should be sufficient, as it cannot be running, no?
> error_propagate(errp, err);
> }
>
> +static void s390_cpu_unrealizefn(DeviceState *dev, Error **errp)
> +{
> + S390CPUClass *scc = S390_CPU_GET_CLASS(dev);
> + Error *err = NULL;
> +
> +#if !defined(CONFIG_USER_ONLY)
> + S390CPU *cpu = S390_CPU(dev);
> +
> + timer_del(cpu->env.tod_timer);
> + timer_del(cpu->env.cpu_timer);
> + timer_free(cpu->env.tod_timer);
> + timer_free(cpu->env.cpu_timer);
> +#endif
> +
> + scc->parent_unrealize(dev, &err);
> + if (err != NULL) {
> + error_propagate(errp, err);
> + return;
> + }
> +}
Simply a
scc->parent_unrealize(dev, errp) and you can drop the temporary variable.
--
Thanks,
David / dhildenb
On 3/5/2020 4:34 PM, David Hildenbrand wrote:
>
>> #if !defined(CONFIG_USER_ONLY)
>> MachineState *ms = MACHINE(qdev_get_machine());
>> unsigned int max_cpus = ms->smp.max_cpus;
>> +
>> + cpu->env.tod_timer =
>> + timer_new_ns(QEMU_CLOCK_VIRTUAL, s390x_tod_timer, cpu);
>> + cpu->env.cpu_timer =
>> + timer_new_ns(QEMU_CLOCK_VIRTUAL, s390x_cpu_timer, cpu);
>> +
>> if (cpu->env.core_id >= max_cpus) {
>> error_setg(&err, "Unable to add CPU with core-id: %" PRIu32
>> ", maximum core-id: %d", cpu->env.core_id,
>> @@ -224,9 +230,38 @@ static void s390_cpu_realizefn(DeviceState *dev, Error **errp)
>>
>> scc->parent_realize(dev, &err);
>> out:
>> + if (cpu->env.tod_timer) {
>> + timer_del(cpu->env.tod_timer);
>> + }
>> + if (cpu->env.cpu_timer) {
>> + timer_del(cpu->env.cpu_timer);
>> + }
>> + timer_free(cpu->env.tod_timer);
>> + timer_free(cpu->env.cpu_timer);
>
> timer_free() should be sufficient, as it cannot be running, no?
Yes, it's redundant.
>
>> error_propagate(errp, err);
>> }
>>
>> +static void s390_cpu_unrealizefn(DeviceState *dev, Error **errp)
>> +{
>> + S390CPUClass *scc = S390_CPU_GET_CLASS(dev);
>> + Error *err = NULL;
>> +
>> +#if !defined(CONFIG_USER_ONLY)
>> + S390CPU *cpu = S390_CPU(dev);
>> +
>> + timer_del(cpu->env.tod_timer);
>> + timer_del(cpu->env.cpu_timer);
>> + timer_free(cpu->env.tod_timer);
>> + timer_free(cpu->env.cpu_timer);
>> +#endif
>> +
>> + scc->parent_unrealize(dev, &err);
>> + if (err != NULL) {
>> + error_propagate(errp, err);
>> + return;
>> + }
>> +}
>
> Simply a
>
> scc->parent_unrealize(dev, errp) and you can drop the temporary variable.
Fine, it looks more clear and I will change it.
And I think it's the same on x86_cpu_unrealize/ppc_cpu_unrealize, I refer to the implement of them.
Thanks.
>
>
© 2016 - 2025 Red Hat, Inc.