| Message ID | 20200314084730.25876-2-pannengyuan@huawei.com |
|---|---|
| State | New |
| Headers | show |
| Series | delay timer_new from init to realize to fix memleaks. | expand |
On Sat, 14 Mar 2020 16:47:27 +0800 Pan Nengyuan <pannengyuan@huawei.com> wrote: > This patch fix memleaks when we call tests/qtest/cpu-plug-test on s390x. The leak stack is as follow: > > Direct leak of 48 byte(s) in 1 object(s) allocated from: > #0 0x7fb43c7cd970 in __interceptor_calloc (/lib64/libasan.so.5+0xef970) > #1 0x7fb43be2149d in g_malloc0 (/lib64/libglib-2.0.so.0+0x5249d) > #2 0x558ba96da716 in timer_new_full /mnt/sdb/qemu-new/qemu/include/qemu/timer.h:530 > #3 0x558ba96da716 in timer_new /mnt/sdb/qemu-new/qemu/include/qemu/timer.h:551 > #4 0x558ba96da716 in timer_new_ns /mnt/sdb/qemu-new/qemu/include/qemu/timer.h:569 > #5 0x558ba96da716 in s390_cpu_initfn /mnt/sdb/qemu-new/qemu/target/s390x/cpu.c:285 > #6 0x558ba9c969ab in object_init_with_type /mnt/sdb/qemu-new/qemu/qom/object.c:372 > #7 0x558ba9c9eb5f in object_initialize_with_type /mnt/sdb/qemu-new/qemu/qom/object.c:516 > #8 0x558ba9c9f053 in object_new_with_type /mnt/sdb/qemu-new/qemu/qom/object.c:684 > #9 0x558ba967ede6 in s390x_new_cpu /mnt/sdb/qemu-new/qemu/hw/s390x/s390-virtio-ccw.c:64 > #10 0x558ba99764b3 in hmp_cpu_add /mnt/sdb/qemu-new/qemu/hw/core/machine-hmp-cmds.c:57 > #11 0x558ba9b1c27f in handle_hmp_command /mnt/sdb/qemu-new/qemu/monitor/hmp.c:1082 > #12 0x558ba96c1b02 in qmp_human_monitor_command /mnt/sdb/qemu-new/qemu/monitor/misc.c:142 > > Reported-by: Euler Robot <euler.robot@huawei.com> > Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com> > --- > Cc: Richard Henderson <rth@twiddle.net> > Cc: David Hildenbrand <david@redhat.com> > Cc: Cornelia Huck <cohuck@redhat.com> > Cc: qemu-s390x@nongnu.org > --- > v2->v1: > - Similarly to other cleanups, move timer_new into realize(Suggested by Philippe Mathieu-Daudé) > v3->v2: > - Also do the timer_free in unrealize, it seems balanced. > v4->v3: > - Also do timer_free on the error path in realize() and fix some coding style. > - Use device_class_set_parent_unrealize to declare unrealize. > v5->v4: > - remove timer_del on the error path of realize(), it's redundant. (Suggested by David Hildenbrand) > - Simply use errp instead a temporary variable. (Suggested by David Hildenbrand) > --- > target/s390x/cpu-qom.h | 1 + > target/s390x/cpu.c | 30 ++++++++++++++++++++++++++---- > 2 files changed, 27 insertions(+), 4 deletions(-) Patch seems fine now (more review still welcome :) Question: should I take this through the s390-fixes branch, or will somebody else queue the whole series?
diff --git a/target/s390x/cpu-qom.h b/target/s390x/cpu-qom.h index dbe5346ec9..af9ffed0d8 100644 --- a/target/s390x/cpu-qom.h +++ b/target/s390x/cpu-qom.h @@ -61,6 +61,7 @@ typedef struct S390CPUClass { const char *desc; DeviceRealize parent_realize; + DeviceUnrealize parent_unrealize; void (*parent_reset)(CPUState *cpu); void (*load_normal)(CPUState *cpu); void (*reset)(CPUState *cpu, cpu_reset_type type); diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c index cf84d307c6..8ce38bf399 100644 --- a/target/s390x/cpu.c +++ b/target/s390x/cpu.c @@ -182,6 +182,12 @@ static void s390_cpu_realizefn(DeviceState *dev, Error **errp) #if !defined(CONFIG_USER_ONLY) MachineState *ms = MACHINE(qdev_get_machine()); unsigned int max_cpus = ms->smp.max_cpus; + + cpu->env.tod_timer = + timer_new_ns(QEMU_CLOCK_VIRTUAL, s390x_tod_timer, cpu); + cpu->env.cpu_timer = + timer_new_ns(QEMU_CLOCK_VIRTUAL, s390x_cpu_timer, cpu); + if (cpu->env.core_id >= max_cpus) { error_setg(&err, "Unable to add CPU with core-id: %" PRIu32 ", maximum core-id: %d", cpu->env.core_id, @@ -224,9 +230,27 @@ static void s390_cpu_realizefn(DeviceState *dev, Error **errp) scc->parent_realize(dev, &err); out: + timer_free(cpu->env.tod_timer); + timer_free(cpu->env.cpu_timer); error_propagate(errp, err); } +static void s390_cpu_unrealizefn(DeviceState *dev, Error **errp) +{ + S390CPUClass *scc = S390_CPU_GET_CLASS(dev); + +#if !defined(CONFIG_USER_ONLY) + S390CPU *cpu = S390_CPU(dev); + + timer_del(cpu->env.tod_timer); + timer_del(cpu->env.cpu_timer); + timer_free(cpu->env.tod_timer); + timer_free(cpu->env.cpu_timer); +#endif + + scc->parent_unrealize(dev, errp); +} + static GuestPanicInformation *s390_cpu_get_crash_info(CPUState *cs) { GuestPanicInformation *panic_info; @@ -279,10 +303,6 @@ static void s390_cpu_initfn(Object *obj) s390_cpu_get_crash_info_qom, NULL, NULL, NULL, NULL); s390_cpu_model_register_props(obj); #if !defined(CONFIG_USER_ONLY) - cpu->env.tod_timer = - timer_new_ns(QEMU_CLOCK_VIRTUAL, s390x_tod_timer, cpu); - cpu->env.cpu_timer = - timer_new_ns(QEMU_CLOCK_VIRTUAL, s390x_cpu_timer, cpu); s390_cpu_set_state(S390_CPU_STATE_STOPPED, cpu); #endif } @@ -453,6 +473,8 @@ static void s390_cpu_class_init(ObjectClass *oc, void *data) device_class_set_parent_realize(dc, s390_cpu_realizefn, &scc->parent_realize); + device_class_set_parent_unrealize(dc, s390_cpu_unrealizefn, + &scc->parent_unrealize); device_class_set_props(dc, s390x_cpu_properties); dc->user_creatable = true;
This patch fix memleaks when we call tests/qtest/cpu-plug-test on s390x. The leak stack is as follow: Direct leak of 48 byte(s) in 1 object(s) allocated from: #0 0x7fb43c7cd970 in __interceptor_calloc (/lib64/libasan.so.5+0xef970) #1 0x7fb43be2149d in g_malloc0 (/lib64/libglib-2.0.so.0+0x5249d) #2 0x558ba96da716 in timer_new_full /mnt/sdb/qemu-new/qemu/include/qemu/timer.h:530 #3 0x558ba96da716 in timer_new /mnt/sdb/qemu-new/qemu/include/qemu/timer.h:551 #4 0x558ba96da716 in timer_new_ns /mnt/sdb/qemu-new/qemu/include/qemu/timer.h:569 #5 0x558ba96da716 in s390_cpu_initfn /mnt/sdb/qemu-new/qemu/target/s390x/cpu.c:285 #6 0x558ba9c969ab in object_init_with_type /mnt/sdb/qemu-new/qemu/qom/object.c:372 #7 0x558ba9c9eb5f in object_initialize_with_type /mnt/sdb/qemu-new/qemu/qom/object.c:516 #8 0x558ba9c9f053 in object_new_with_type /mnt/sdb/qemu-new/qemu/qom/object.c:684 #9 0x558ba967ede6 in s390x_new_cpu /mnt/sdb/qemu-new/qemu/hw/s390x/s390-virtio-ccw.c:64 #10 0x558ba99764b3 in hmp_cpu_add /mnt/sdb/qemu-new/qemu/hw/core/machine-hmp-cmds.c:57 #11 0x558ba9b1c27f in handle_hmp_command /mnt/sdb/qemu-new/qemu/monitor/hmp.c:1082 #12 0x558ba96c1b02 in qmp_human_monitor_command /mnt/sdb/qemu-new/qemu/monitor/misc.c:142 Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com> --- Cc: Richard Henderson <rth@twiddle.net> Cc: David Hildenbrand <david@redhat.com> Cc: Cornelia Huck <cohuck@redhat.com> Cc: qemu-s390x@nongnu.org --- v2->v1: - Similarly to other cleanups, move timer_new into realize(Suggested by Philippe Mathieu-Daudé) v3->v2: - Also do the timer_free in unrealize, it seems balanced. v4->v3: - Also do timer_free on the error path in realize() and fix some coding style. - Use device_class_set_parent_unrealize to declare unrealize. v5->v4: - remove timer_del on the error path of realize(), it's redundant. (Suggested by David Hildenbrand) - Simply use errp instead a temporary variable. (Suggested by David Hildenbrand) --- target/s390x/cpu-qom.h | 1 + target/s390x/cpu.c | 30 ++++++++++++++++++++++++++---- 2 files changed, 27 insertions(+), 4 deletions(-)