From bce410a33b9ed51051eb6a1fb31f8d0c13a51d48 Mon Sep 17 00:00:00 2001 From: Igor Mammedov Date: Thu, 1 Nov 2018 11:44:46 +0100 Subject: [PATCH] ivshmem: fix memory backend leak MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit object_new() returns a new backend with refcount == 1 and then later object_property_add_child() increases refcount to 2 So when ivshmem is destroyed, the backend it has created isn't destroyed along with it as children cleanup will bring backend's refcount only to 1, which leaks backend including resources it is using. Drop the original reference from object_new() once backend is attached to its parent. Signed-off-by: Igor Mammedov Message-Id: <1541069086-167036-1-git-send-email-imammedo@redhat.com> Reviewed-by: Marc-André Lureau Fixes: 5503e285041979dd29698ecb41729b3b22622e8d Signed-off-by: Paolo Bonzini --- hw/misc/ivshmem.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c index f88910e55c..ecfd10a29a 100644 --- a/hw/misc/ivshmem.c +++ b/hw/misc/ivshmem.c @@ -1279,6 +1279,7 @@ static void desugar_shm(IVShmemState *s) object_property_set_bool(obj, true, "share", &error_abort); object_property_add_child(OBJECT(s), "internal-shm-backend", obj, &error_abort); + object_unref(obj); user_creatable_complete(obj, &error_abort); s->hostmem = MEMORY_BACKEND(obj); }