From: Alex Williamson <alex.william...@redhat.com> Commit d8d95814609e added explicit object_unparent() calls for dynamically allocated MemoryRegions. The VFIOMSIXInfo structure also contains such a MemoryRegion, covering the mmap'd region of a PCI BAR above the MSI-X table. This structure is freed as part of the class exit function and therefore also needs an explicit object_unparent(). Failing to do this results in random segfaults due to fields within the structure, often the class pointer, being reclaimed and corrupted by the time object_finalize_child_property() is called for the object.
Signed-off-by: Alex Williamson <alex.william...@redhat.com> Reviewed-by: Paolo Bonzini <pbonz...@redhat.com> Cc: qemu-sta...@nongnu.org # 2.2 (cherry picked from commit 3a4dbe6aa934370a92372528c1255ee1504965ee) Signed-off-by: Michael Roth <mdr...@linux.vnet.ibm.com> --- hw/misc/vfio.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/misc/vfio.c b/hw/misc/vfio.c index fd318a1..7bff62c 100644 --- a/hw/misc/vfio.c +++ b/hw/misc/vfio.c @@ -4049,6 +4049,7 @@ static void vfio_put_device(VFIODevice *vdev) DPRINTF("vfio_put_device: close vdev->fd\n"); close(vdev->fd); if (vdev->msix) { + object_unparent(OBJECT(&vdev->msix->mmap_mem)); g_free(vdev->msix); vdev->msix = NULL; } -- 1.9.1