On 6/3/2020 2:51 PM, Philippe Mathieu-Daudé wrote:
> Hi Pan,
>
> On 6/3/20 9:03 AM, Pan Nengyuan wrote:
>> 'obj' forgot to free at the end of hmp_qom_get(). Fix that.
>>
>> The leak stack:
>> Direct leak of 40 byte(s) in 1 object(s) allocated from:
>> #0 0x7f4e3a779ae8 in __interceptor_malloc (/lib64/libasan.so.5+0xefae8)
>> #1 0x7f4e398f91d5 in g_malloc (/lib64/libglib-2.0.so.0+0x531d5)
>> #2 0x55c9fd9a3999 in qstring_from_substr
>> /build/qemu/src/qobject/qstring.c:45
>> #3 0x55c9fd894bd3 in qobject_output_type_str
>> /build/qemu/src/qapi/qobject-output-visitor.c:175
>> #4 0x55c9fd894bd3 in qobject_output_type_str
>> /build/qemu/src/qapi/qobject-output-visitor.c:168
>> #5 0x55c9fd88b34d in visit_type_str
>> /build/qemu/src/qapi/qapi-visit-core.c:308
>> #6 0x55c9fd59aa6b in property_get_str /build/qemu/src/qom/object.c:2064
>> #7 0x55c9fd5adb8a in object_property_get_qobject
>> /build/qemu/src/qom/qom-qobject.c:38
>> #8 0x55c9fd4a029d in hmp_qom_get /build/qemu/src/qom/qom-hmp-cmds.c:66
>>
>> Fixes: 89cf4fe34f4
>
> When you fix a bug in a specific commit, please Cc the commit author and
> the reviewers, so they have a chance to 1/ review your fix and 2/ learn
> from their mistake.
Ok, I will do next time.
>
>> Reported-by: Euler Robot <euler.ro...@huawei.com>
>> Signed-off-by: Pan Nengyuan <pannengy...@huawei.com>
>> ---
>> qom/qom-hmp-cmds.c | 1 +
>> 1 file changed, 1 insertion(+)
>>
>> diff --git a/qom/qom-hmp-cmds.c b/qom/qom-hmp-cmds.c
>> index f704b6949a..3d2a23292d 100644
>> --- a/qom/qom-hmp-cmds.c
>> +++ b/qom/qom-hmp-cmds.c
>> @@ -71,6 +71,7 @@ void hmp_qom_get(Monitor *mon, const QDict *qdict)
>> qobject_unref(str);
>> }
>>
>> + qobject_unref(obj);
>
> The object_resolve_path() documentation is not clear about that...
> Can we get the documentation clarified?
I'm not sure why is object_resolve_path().
In this case, 'obj' is returned from object_property_get_qobject() in
qmp_qom_get().
Do you mean document object_property_get_qobject() to make it more clear?
Like:
- The returned object has a reference count of 1, and will be freed when the
last reference is dropped.
Thanks.
>
>> hmp_handle_error(mon, err);
>> }
>>
>>
>
