When running device-introspect-test, a memory leak occurred in the s390_cpu_initfn
function, this patch use timer_free() in the finalize function to fix it.

ASAN shows memory leak stack:

Direct leak of 3552 byte(s) in 74 object(s) allocated from:
    #0 0xfffeb3d4e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
    #1 0xfffeb36e6800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
    #2 0xaaad51a8f9c4 in timer_new_full qemu/include/qemu/timer.h:523
    #3 0xaaad51a8f9c4 in timer_new qemu/include/qemu/timer.h:544
    #4 0xaaad51a8f9c4 in timer_new_ns qemu/include/qemu/timer.h:562
    #5 0xaaad51a8f9c4 in s390_cpu_initfn qemu/target/s390x/cpu.c:304
    #6 0xaaad51e00f58 in object_init_with_type qemu/qom/object.c:371
    #7 0xaaad51e0406c in object_initialize_with_type qemu/qom/object.c:515
    #8 0xaaad51e042e0 in object_new_with_type qemu/qom/object.c:729
    #9 0xaaad51e3ff40 in qmp_device_list_properties qemu/qom/qom-qmp-cmds.c:153
    #10 0xaaad51910518 in qdev_device_help qemu/softmmu/qdev-monitor.c:283
    #11 0xaaad51911918 in qmp_device_add qemu/softmmu/qdev-monitor.c:801
    #12 0xaaad51911e48 in hmp_device_add qemu/softmmu/qdev-monitor.c:916

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Gan Qixin <ganqixin@huawei.com>
---
Cc: Thomas Huth <thuth@redhat.com>
---
 target/s390x/cpu.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index 7b66718c44..8a734c2f8c 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -313,6 +313,11 @@ static void s390_cpu_finalize(Object *obj)
 #if !defined(CONFIG_USER_ONLY)
     S390CPU *cpu = S390_CPU(obj);
 
+    timer_del(cpu->env.tod_timer);
+    timer_free(cpu->env.tod_timer);
+    timer_del(cpu->env.cpu_timer);
+    timer_free(cpu->env.cpu_timer);
+
     qemu_unregister_reset(s390_cpu_machine_reset_cb, cpu);
     g_free(cpu->irqstate);
 #endif
-- 
2.27.0

On Fri, 4 Dec 2020 16:12:09 +0800
Gan Qixin <ganqixin@huawei.com> wrote:

> When running device-introspect-test, a memory leak occurred in the s390_cpu_initfn
> function, this patch use timer_free() in the finalize function to fix it.
> 
> ASAN shows memory leak stack:
> 
> Direct leak of 3552 byte(s) in 74 object(s) allocated from:
>     #0 0xfffeb3d4e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
>     #1 0xfffeb36e6800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
>     #2 0xaaad51a8f9c4 in timer_new_full qemu/include/qemu/timer.h:523
>     #3 0xaaad51a8f9c4 in timer_new qemu/include/qemu/timer.h:544
>     #4 0xaaad51a8f9c4 in timer_new_ns qemu/include/qemu/timer.h:562
>     #5 0xaaad51a8f9c4 in s390_cpu_initfn qemu/target/s390x/cpu.c:304
>     #6 0xaaad51e00f58 in object_init_with_type qemu/qom/object.c:371
>     #7 0xaaad51e0406c in object_initialize_with_type qemu/qom/object.c:515
>     #8 0xaaad51e042e0 in object_new_with_type qemu/qom/object.c:729
>     #9 0xaaad51e3ff40 in qmp_device_list_properties qemu/qom/qom-qmp-cmds.c:153
>     #10 0xaaad51910518 in qdev_device_help qemu/softmmu/qdev-monitor.c:283
>     #11 0xaaad51911918 in qmp_device_add qemu/softmmu/qdev-monitor.c:801
>     #12 0xaaad51911e48 in hmp_device_add qemu/softmmu/qdev-monitor.c:916
> 
> Reported-by: Euler Robot <euler.robot@huawei.com>
> Signed-off-by: Gan Qixin <ganqixin@huawei.com>
> ---
> Cc: Thomas Huth <thuth@redhat.com>

[Adding missing maintainers. How did you build the cc: list?]

> ---
>  target/s390x/cpu.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
> index 7b66718c44..8a734c2f8c 100644
> --- a/target/s390x/cpu.c
> +++ b/target/s390x/cpu.c
> @@ -313,6 +313,11 @@ static void s390_cpu_finalize(Object *obj)
>  #if !defined(CONFIG_USER_ONLY)
>      S390CPU *cpu = S390_CPU(obj);
>  
> +    timer_del(cpu->env.tod_timer);
> +    timer_free(cpu->env.tod_timer);
> +    timer_del(cpu->env.cpu_timer);
> +    timer_free(cpu->env.cpu_timer);
> +
>      qemu_unregister_reset(s390_cpu_machine_reset_cb, cpu);
>      g_free(cpu->irqstate);
>  #endif

Looks sane at first glance.

On 04.12.20 09:36, Cornelia Huck wrote:
> On Fri, 4 Dec 2020 16:12:09 +0800
> Gan Qixin <ganqixin@huawei.com> wrote:
> 
>> When running device-introspect-test, a memory leak occurred in the s390_cpu_initfn
>> function, this patch use timer_free() in the finalize function to fix it.
>>
>> ASAN shows memory leak stack:
>>
>> Direct leak of 3552 byte(s) in 74 object(s) allocated from:
>>     #0 0xfffeb3d4e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
>>     #1 0xfffeb36e6800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
>>     #2 0xaaad51a8f9c4 in timer_new_full qemu/include/qemu/timer.h:523
>>     #3 0xaaad51a8f9c4 in timer_new qemu/include/qemu/timer.h:544
>>     #4 0xaaad51a8f9c4 in timer_new_ns qemu/include/qemu/timer.h:562
>>     #5 0xaaad51a8f9c4 in s390_cpu_initfn qemu/target/s390x/cpu.c:304
>>     #6 0xaaad51e00f58 in object_init_with_type qemu/qom/object.c:371
>>     #7 0xaaad51e0406c in object_initialize_with_type qemu/qom/object.c:515
>>     #8 0xaaad51e042e0 in object_new_with_type qemu/qom/object.c:729
>>     #9 0xaaad51e3ff40 in qmp_device_list_properties qemu/qom/qom-qmp-cmds.c:153
>>     #10 0xaaad51910518 in qdev_device_help qemu/softmmu/qdev-monitor.c:283
>>     #11 0xaaad51911918 in qmp_device_add qemu/softmmu/qdev-monitor.c:801
>>     #12 0xaaad51911e48 in hmp_device_add qemu/softmmu/qdev-monitor.c:916
>>
>> Reported-by: Euler Robot <euler.robot@huawei.com>
>> Signed-off-by: Gan Qixin <ganqixin@huawei.com>
>> ---
>> Cc: Thomas Huth <thuth@redhat.com>
> 
> [Adding missing maintainers. How did you build the cc: list?]
> 
>> ---
>>  target/s390x/cpu.c | 5 +++++
>>  1 file changed, 5 insertions(+)
>>
>> diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
>> index 7b66718c44..8a734c2f8c 100644
>> --- a/target/s390x/cpu.c
>> +++ b/target/s390x/cpu.c
>> @@ -313,6 +313,11 @@ static void s390_cpu_finalize(Object *obj)
>>  #if !defined(CONFIG_USER_ONLY)
>>      S390CPU *cpu = S390_CPU(obj);
>>  
>> +    timer_del(cpu->env.tod_timer);
>> +    timer_free(cpu->env.tod_timer);
>> +    timer_del(cpu->env.cpu_timer);
>> +    timer_free(cpu->env.cpu_timer);
>> +
>>      qemu_unregister_reset(s390_cpu_machine_reset_cb, cpu);
>>      g_free(cpu->irqstate);
>>  #endif
> 
> Looks sane at first glance.
> 

Could have sworn we had these in the code at one point - but I don't
find anything in the git history.

Reviewed-by: David Hildenbrand <david@redhat.com>

-- 
Thanks,

David / dhildenb

> -----Original Message-----
> From: Cornelia Huck [mailto:cohuck@redhat.com]
> Sent: Friday, December 4, 2020 4:37 PM
> To: ganqixin <ganqixin@huawei.com>
> Cc: qemu-devel@nongnu.org; qemu-trivial@nongnu.org;
> peter.maydell@linaro.org; thuth@redhat.com; Zhanghailiang
> <zhang.zhanghailiang@huawei.com>; Euler Robot
> <euler.robot@huawei.com>; Chenqun (kuhn)
> <kuhn.chenqun@huawei.com>; david@gibson.dropbear.id.au; Richard
> Henderson <richard.henderson@linaro.org>; David Hildenbrand
> <david@redhat.com>; qemu-s390x@nongnu.org
> Subject: Re: [PATCH 3/3] s390x/cpu: Use timer_free() in the finalize
> function to avoid memleaks
> 
> On Fri, 4 Dec 2020 16:12:09 +0800
> Gan Qixin <ganqixin@huawei.com> wrote:
> 
> > When running device-introspect-test, a memory leak occurred in the
> > s390_cpu_initfn function, this patch use timer_free() in the finalize
> function to fix it.
> >
> > ASAN shows memory leak stack:
> >
> > Direct leak of 3552 byte(s) in 74 object(s) allocated from:
> >     #0 0xfffeb3d4e1f0 in __interceptor_calloc
> (/lib64/libasan.so.5+0xee1f0)
> >     #1 0xfffeb36e6800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
> >     #2 0xaaad51a8f9c4 in timer_new_full
> qemu/include/qemu/timer.h:523
> >     #3 0xaaad51a8f9c4 in timer_new qemu/include/qemu/timer.h:544
> >     #4 0xaaad51a8f9c4 in timer_new_ns
> qemu/include/qemu/timer.h:562
> >     #5 0xaaad51a8f9c4 in s390_cpu_initfn
> qemu/target/s390x/cpu.c:304
> >     #6 0xaaad51e00f58 in object_init_with_type
> qemu/qom/object.c:371
> >     #7 0xaaad51e0406c in object_initialize_with_type
> qemu/qom/object.c:515
> >     #8 0xaaad51e042e0 in object_new_with_type
> qemu/qom/object.c:729
> >     #9 0xaaad51e3ff40 in qmp_device_list_properties
> qemu/qom/qom-qmp-cmds.c:153
> >     #10 0xaaad51910518 in qdev_device_help
> qemu/softmmu/qdev-monitor.c:283
> >     #11 0xaaad51911918 in qmp_device_add
> qemu/softmmu/qdev-monitor.c:801
> >     #12 0xaaad51911e48 in hmp_device_add
> > qemu/softmmu/qdev-monitor.c:916
> >
> > Reported-by: Euler Robot <euler.robot@huawei.com>
> > Signed-off-by: Gan Qixin <ganqixin@huawei.com>
> > ---
> > Cc: Thomas Huth <thuth@redhat.com>
> 
> [Adding missing maintainers. How did you build the cc: list?]

Oops, It's my fault. Thanks for helping me add missing maintainers. :)

Gan Qixin
> 
> > ---
> >  target/s390x/cpu.c | 5 +++++
> >  1 file changed, 5 insertions(+)
> >
> > diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c index
> > 7b66718c44..8a734c2f8c 100644
> > --- a/target/s390x/cpu.c
> > +++ b/target/s390x/cpu.c
> > @@ -313,6 +313,11 @@ static void s390_cpu_finalize(Object *obj)  #if
> > !defined(CONFIG_USER_ONLY)
> >      S390CPU *cpu = S390_CPU(obj);
> >
> > +    timer_del(cpu->env.tod_timer);
> > +    timer_free(cpu->env.tod_timer);
> > +    timer_del(cpu->env.cpu_timer);
> > +    timer_free(cpu->env.cpu_timer);
> > +
> >      qemu_unregister_reset(s390_cpu_machine_reset_cb, cpu);
> >      g_free(cpu->irqstate);
> >  #endif
> 
> Looks sane at first glance.

On Fri, 4 Dec 2020 16:12:09 +0800
Gan Qixin <ganqixin@huawei.com> wrote:

> When running device-introspect-test, a memory leak occurred in the s390_cpu_initfn
> function, this patch use timer_free() in the finalize function to fix it.
> 
> ASAN shows memory leak stack:
> 
> Direct leak of 3552 byte(s) in 74 object(s) allocated from:
>     #0 0xfffeb3d4e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
>     #1 0xfffeb36e6800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
>     #2 0xaaad51a8f9c4 in timer_new_full qemu/include/qemu/timer.h:523
>     #3 0xaaad51a8f9c4 in timer_new qemu/include/qemu/timer.h:544
>     #4 0xaaad51a8f9c4 in timer_new_ns qemu/include/qemu/timer.h:562
>     #5 0xaaad51a8f9c4 in s390_cpu_initfn qemu/target/s390x/cpu.c:304
>     #6 0xaaad51e00f58 in object_init_with_type qemu/qom/object.c:371
>     #7 0xaaad51e0406c in object_initialize_with_type qemu/qom/object.c:515
>     #8 0xaaad51e042e0 in object_new_with_type qemu/qom/object.c:729
>     #9 0xaaad51e3ff40 in qmp_device_list_properties qemu/qom/qom-qmp-cmds.c:153
>     #10 0xaaad51910518 in qdev_device_help qemu/softmmu/qdev-monitor.c:283
>     #11 0xaaad51911918 in qmp_device_add qemu/softmmu/qdev-monitor.c:801
>     #12 0xaaad51911e48 in hmp_device_add qemu/softmmu/qdev-monitor.c:916
> 
> Reported-by: Euler Robot <euler.robot@huawei.com>
> Signed-off-by: Gan Qixin <ganqixin@huawei.com>
> ---
> Cc: Thomas Huth <thuth@redhat.com>
> ---
>  target/s390x/cpu.c | 5 +++++
>  1 file changed, 5 insertions(+)

Thanks, applied.