Adds a function to test if a given DeviceListener object is in use. This
is necessary to confirm we're not unregistering an object that is not in
use, which results in a crash.

Fixes a crash when we execute "qom-list-properties" QMP command on the
"x-remote-object":
https://www.mail-archive.com/qemu-devel@nongnu.org/msg1185472.html

Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
---
 hw/core/qdev.c         | 5 +++++
 hw/remote/remote-obj.c | 4 +++-
 include/hw/core/qdev.h | 1 +
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/hw/core/qdev.c b/hw/core/qdev.c
index e48616b2c6..97b09f6e7f 100644
--- a/hw/core/qdev.c
+++ b/hw/core/qdev.c
@@ -208,6 +208,11 @@ void device_listener_unregister(DeviceListener *listener)
     QTAILQ_REMOVE(&device_listeners, listener, link);
 }
 
+bool device_listener_is_registered(DeviceListener *listener)
+{
+	return QTAILQ_IN_USE(listener, link);
+}
+
 bool qdev_should_hide_device(const QDict *opts, bool from_json, Error **errp)
 {
     ERRP_GUARD();
diff --git a/hw/remote/remote-obj.c b/hw/remote/remote-obj.c
index 86192dc8da..122e30af7e 100644
--- a/hw/remote/remote-obj.c
+++ b/hw/remote/remote-obj.c
@@ -154,7 +154,9 @@ static void remote_object_finalize(Object *obj)
     RemoteObjectClass *k = REMOTE_OBJECT_GET_CLASS(obj);
     RemoteObject *o = REMOTE_OBJECT(obj);
 
-    device_listener_unregister(&o->listener);
+    if (device_listener_is_registered(&o->listener)) {
+        device_listener_unregister(&o->listener);
+    }
 
     if (o->ioc) {
         qio_channel_shutdown(o->ioc, QIO_CHANNEL_SHUTDOWN_BOTH, NULL);
diff --git a/include/hw/core/qdev.h b/include/hw/core/qdev.h
index f99a8979cc..150113584e 100644
--- a/include/hw/core/qdev.h
+++ b/include/hw/core/qdev.h
@@ -1146,6 +1146,7 @@ static inline void qbus_mark_full(BusState *bus)
 
 void device_listener_register(DeviceListener *listener);
 void device_listener_unregister(DeviceListener *listener);
+bool device_listener_is_registered(DeviceListener *listener);
 
 /**
  * qdev_should_hide_device() - check if device should be hidden
-- 
2.51.0

On Mon, 27 Apr 2026 at 18:43, Jagannathan Raman <jag.raman@oracle.com> wrote:
>
> Adds a function to test if a given DeviceListener object is in use. This
> is necessary to confirm we're not unregistering an object that is not in
> use, which results in a crash.
>
> Fixes a crash when we execute "qom-list-properties" QMP command on the
> "x-remote-object":
> https://www.mail-archive.com/qemu-devel@nongnu.org/msg1185472.html
>
> Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
> ---
>  hw/core/qdev.c         | 5 +++++
>  hw/remote/remote-obj.c | 4 +++-
>  include/hw/core/qdev.h | 1 +
>  3 files changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/hw/core/qdev.c b/hw/core/qdev.c
> index e48616b2c6..97b09f6e7f 100644
> --- a/hw/core/qdev.c
> +++ b/hw/core/qdev.c
> @@ -208,6 +208,11 @@ void device_listener_unregister(DeviceListener *listener)
>      QTAILQ_REMOVE(&device_listeners, listener, link);
>  }
>
> +bool device_listener_is_registered(DeviceListener *listener)
> +{
> +       return QTAILQ_IN_USE(listener, link);
> +}

The approach used by memory_listener_register() and
memory_listener_unregister() is that the latter is a
no-op for a MemoryListener that's not currently
registered (we test for listener->address_space is NULL,
and at the end of unregister we set it to NULL). Would
it be possible to follow the same API pattern for
DeviceListener rather than introducing an is_registered
function ?

thanks
-- PMM

On 4/27/26 3:48 PM, Peter Maydell wrote:
> On Mon, 27 Apr 2026 at 18:43, Jagannathan Raman<jag.raman@oracle.com> wrote:
>> Adds a function to test if a given DeviceListener object is in use. This
>> is necessary to confirm we're not unregistering an object that is not in
>> use, which results in a crash.
>>
>> Fixes a crash when we execute "qom-list-properties" QMP command on the
>> "x-remote-object":
>> https://www.mail-archive.com/qemu-devel@nongnu.org/msg1185472.html
>>
>> Signed-off-by: Jagannathan Raman<jag.raman@oracle.com>
>> ---
>>   hw/core/qdev.c         | 5 +++++
>>   hw/remote/remote-obj.c | 4 +++-
>>   include/hw/core/qdev.h | 1 +
>>   3 files changed, 9 insertions(+), 1 deletion(-)
>>
>> diff --git a/hw/core/qdev.c b/hw/core/qdev.c
>> index e48616b2c6..97b09f6e7f 100644
>> --- a/hw/core/qdev.c
>> +++ b/hw/core/qdev.c
>> @@ -208,6 +208,11 @@ void device_listener_unregister(DeviceListener *listener)
>>       QTAILQ_REMOVE(&device_listeners, listener, link);
>>   }
>>
>> +bool device_listener_is_registered(DeviceListener *listener)
>> +{
>> +       return QTAILQ_IN_USE(listener, link);
>> +}
> The approach used by memory_listener_register() and
> memory_listener_unregister() is that the latter is a
> no-op for a MemoryListener that's not currently
> registered (we test for listener->address_space is NULL,
> and at the end of unregister we set it to NULL). Would
> it be possible to follow the same API pattern for
> DeviceListener rather than introducing an is_registered
> function ?
Thanks, Peter! I believe sticking to the above pattern is better to remain
consistent with the existing MemoryListener implementation.

Marc-Andre just published a patch which does something 
similar:https://patchew.org/QEMU/20260427-qom-tests-v1-0-c413f3605311@redhat.com/20260427-qom-tests-v1-9-c413f3605311@redhat.com/

I'll follow up with him also.

Thanks,
Jag
>
> thanks
> -- PMM