From a6e9b9123e7e24085b16a001a04f9059269c57c5 Mon Sep 17 00:00:00 2001 From: Luc Michel Date: Tue, 20 Oct 2020 11:10:24 +0200 Subject: [PATCH] hw/core/qdev-clock: add a reference on aliased clocks MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When aliasing a clock with the qdev_alias_clock() function, a new link property is created on the device aliasing the clock. The link points to the aliased clock and use the OBJ_PROP_LINK_STRONG flag. This property is read only since it does not provide a check callback for modifications. The object_property_add_link() documentation stats that with OBJ_PROP_LINK_STRONG properties, the linked object reference count get decremented when the property is deleted. But it is _not_ incremented on creation (object_property_add_link() does not actually know the link). This commit increments the reference count on the aliased clock to ensure the aliased clock stays alive during the property lifetime, and to avoid a double-free memory error when the property gets deleted. Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Luc Michel Message-Id: <20201020091024.320381-1-luc@lmichel.fr> Signed-off-by: Paolo Bonzini --- hw/core/qdev-clock.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/core/qdev-clock.c b/hw/core/qdev-clock.c index 6a9a340d0f..eb05f2a13c 100644 --- a/hw/core/qdev-clock.c +++ b/hw/core/qdev-clock.c @@ -61,6 +61,14 @@ static NamedClockList *qdev_init_clocklist(DeviceState *dev, const char *name, object_get_typename(OBJECT(clk)), (Object **) &ncl->clock, NULL, OBJ_PROP_LINK_STRONG); + /* + * Since the link property has the OBJ_PROP_LINK_STRONG flag, the clk + * object reference count gets decremented on property deletion. + * However object_property_add_link does not increment it since it + * doesn't know the linked object. Increment it here to ensure the + * aliased clock stays alive during this device life-time. + */ + object_ref(OBJECT(clk)); } ncl->clock = clk;