From: Amos Kong <ak...@redhat.com>
Test steps:
(qemu) device_add e1000,addr=adsf
Property 'e1000.addr' doesn't take value 'adsf'
(qemu) info qtree
Then qemu crashed.
Currently we set a link to the new device from its parent bus, but the
device hasn't been added to QOM tree yet. When it fails to set properties,
object_unparent() can't clean up the device.
Delay setting of device properties until the device has been added to
the QOM composition tree. This way, when setting a property fails,
object_unparent() can clean up the device properly.
Signed-off-by: Amos Kong <ak...@redhat.com>
Reviewed-by: Igor Mammedov <imamm...@redhat.com>
Signed-off-by: Andreas Färber <afaer...@suse.de>
---
qdev-monitor.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/qdev-monitor.c b/qdev-monitor.c
index 6673e3c..9268c87 100644
--- a/qdev-monitor.c
+++ b/qdev-monitor.c
@@ -522,7 +522,7 @@ DeviceState *qdev_device_add(QemuOpts *opts)
return NULL;
}
- /* create device, set properties */
+ /* create device */
dev = DEVICE(object_new(driver));
if (bus) {
@@ -533,11 +533,7 @@ DeviceState *qdev_device_add(QemuOpts *opts)
if (id) {
dev->id = id;
}
- if (qemu_opt_foreach(opts, set_property, dev, 1) != 0) {
- object_unparent(OBJECT(dev));
- object_unref(OBJECT(dev));
- return NULL;
- }
+
if (dev->id) {
object_property_add_child(qdev_get_peripheral(), dev->id,
OBJECT(dev), NULL);
@@ -549,6 +545,13 @@ DeviceState *qdev_device_add(QemuOpts *opts)
g_free(name);
}
+ /* set properties */
+ if (qemu_opt_foreach(opts, set_property, dev, 1) != 0) {
+ object_unparent(OBJECT(dev));
+ object_unref(OBJECT(dev));
+ return NULL;
+ }
+
dev->opts = opts;
object_property_set_bool(OBJECT(dev), true, "realized", &err);
if (err != NULL) {
--
1.8.4.5
