[PATCH 0/7] Fix some memleaks caused by ptimer_init

[PATCH 0/7] Fix some memleaks caused by ptimer_init

[Gan Qixin]

Hi all,

When running device-introspect-test, I found some memory leaks caused by
ptimer_init in the init function, so I released it in the finalize function.


Gan Qixin (7):
  allwinner-a10-pit: Use ptimer_free() in the finalize function to avoid
    memleaks
  digic-timer: Use ptimer_free() in the finalize function to avoid
    memleaks
  exynos4210_mct: Use ptimer_free() in the finalize function to avoid
    memleaks
  exynos4210_pwm: Use ptimer_free() in the finalize function to avoid
    memleaks
  exynos4210_rtc: Use ptimer_free() in the finalize function to avoid
    memleaks
  mss-timer: Use ptimer_free() in the finalize function to avoid
    memleaks
  musicpal: Use ptimer_free() in the finalize function to avoid memleaks

 hw/arm/musicpal.c            | 22 +++++++++++++++++-----
 hw/rtc/exynos4210_rtc.c      | 19 ++++++++++++++-----
 hw/timer/allwinner-a10-pit.c | 21 ++++++++++++++++-----
 hw/timer/digic-timer.c       | 18 +++++++++++++-----
 hw/timer/exynos4210_mct.c    | 24 +++++++++++++++++++-----
 hw/timer/exynos4210_pwm.c    | 21 ++++++++++++++++-----
 hw/timer/mss-timer.c         | 23 ++++++++++++++++++-----
 7 files changed, 113 insertions(+), 35 deletions(-)

-- 
2.23.0

[PATCH 1/7] allwinner-a10-pit: Use ptimer_free() in the finalize function to avoid memleaks

[Gan Qixin]

When running device-introspect-test, a memory leak occurred in the a10_pit_init
function, so use ptimer_free() in the finalize function to avoid it.

ASAN shows memory leak stack:

Indirect leak of 288 byte(s) in 6 object(s) allocated from:
    #0 0xffffab97e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
    #1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
    #2 0xaaabf555db84 in timer_new_full /qemu/include/qemu/timer.h:523
    #3 0xaaabf555db84 in timer_new /qemu/include/qemu/timer.h:544
    #4 0xaaabf555db84 in timer_new_ns /qemu/include/qemu/timer.h:562
    #5 0xaaabf555db84 in ptimer_init /qemu/hw/core/ptimer.c:433
    #6 0xaaabf57415e8 in a10_pit_init /qemu/hw/timer/allwinner-a10-pit.c:278
    #7 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
    #8 0xaaabf633ca04 in object_initialize_child_with_propsv /qemu/qom/object.c:564
    #9 0xaaabf633cc08 in object_initialize_child_with_props /qemu/qom/object.c:547
    #10 0xaaabf5b94680 in aw_a10_init /qemu/hw/arm/allwinner-a10.c:49
    #11 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
    #12 0xaaabf633a1e0 in object_new_with_type /qemu/qom/object.c:729

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Gan Qixin <ganqixin@huawei.com>
---
Cc: Beniamino Galvani <b.galvani@gmail.com>
---
 hw/timer/allwinner-a10-pit.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/hw/timer/allwinner-a10-pit.c b/hw/timer/allwinner-a10-pit.c
index f84fc0ea25..be211983b0 100644
--- a/hw/timer/allwinner-a10-pit.c
+++ b/hw/timer/allwinner-a10-pit.c
@@ -279,6 +279,16 @@ static void a10_pit_init(Object *obj)
     }
 }
 
+static void a10_pit_finalize(Object *obj)
+{
+    AwA10PITState *s = AW_A10_PIT(obj);
+    int i;
+
+    for (i = 0; i < AW_A10_PIT_TIMER_NR; i++) {
+        ptimer_free(s->timer[i]);
+    }
+}
+
 static void a10_pit_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -290,11 +300,12 @@ static void a10_pit_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo a10_pit_info = {
-    .name = TYPE_AW_A10_PIT,
-    .parent = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(AwA10PITState),
-    .instance_init = a10_pit_init,
-    .class_init = a10_pit_class_init,
+    .name              = TYPE_AW_A10_PIT,
+    .parent            = TYPE_SYS_BUS_DEVICE,
+    .instance_size     = sizeof(AwA10PITState),
+    .instance_init     = a10_pit_init,
+    .instance_finalize = a10_pit_finalize,
+    .class_init        = a10_pit_class_init,
 };
 
 static void a10_register_types(void)
-- 
2.23.0

Re: [PATCH 1/7] allwinner-a10-pit: Use ptimer_free() in the finalize function to avoid memleaks

[Peter Maydell]

On Fri, 27 Nov 2020 at 07:19, Gan Qixin <ganqixin@huawei.com> wrote:
>
> When running device-introspect-test, a memory leak occurred in the a10_pit_init
> function, so use ptimer_free() in the finalize function to avoid it.
>
> ASAN shows memory leak stack:
>
> Indirect leak of 288 byte(s) in 6 object(s) allocated from:
>     #0 0xffffab97e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
>     #1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
>     #2 0xaaabf555db84 in timer_new_full /qemu/include/qemu/timer.h:523
>     #3 0xaaabf555db84 in timer_new /qemu/include/qemu/timer.h:544
>     #4 0xaaabf555db84 in timer_new_ns /qemu/include/qemu/timer.h:562
>     #5 0xaaabf555db84 in ptimer_init /qemu/hw/core/ptimer.c:433
>     #6 0xaaabf57415e8 in a10_pit_init /qemu/hw/timer/allwinner-a10-pit.c:278
>     #7 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
>     #8 0xaaabf633ca04 in object_initialize_child_with_propsv /qemu/qom/object.c:564
>     #9 0xaaabf633cc08 in object_initialize_child_with_props /qemu/qom/object.c:547
>     #10 0xaaabf5b94680 in aw_a10_init /qemu/hw/arm/allwinner-a10.c:49
>     #11 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
>     #12 0xaaabf633a1e0 in object_new_with_type /qemu/qom/object.c:729
>
> Reported-by: Euler Robot <euler.robot@huawei.com>
> Signed-off-by: Gan Qixin <ganqixin@huawei.com>
> ---
> Cc: Beniamino Galvani <b.galvani@gmail.com>
> ---
>  hw/timer/allwinner-a10-pit.c | 21 ++++++++++++++++-----
>  1 file changed, 16 insertions(+), 5 deletions(-)
>
> diff --git a/hw/timer/allwinner-a10-pit.c b/hw/timer/allwinner-a10-pit.c
> index f84fc0ea25..be211983b0 100644
> --- a/hw/timer/allwinner-a10-pit.c
> +++ b/hw/timer/allwinner-a10-pit.c
> @@ -279,6 +279,16 @@ static void a10_pit_init(Object *obj)
>      }
>  }
>
> +static void a10_pit_finalize(Object *obj)
> +{
> +    AwA10PITState *s = AW_A10_PIT(obj);
> +    int i;
> +
> +    for (i = 0; i < AW_A10_PIT_TIMER_NR; i++) {
> +        ptimer_free(s->timer[i]);
> +    }
> +}
> +
>  static void a10_pit_class_init(ObjectClass *klass, void *data)
>  {
>      DeviceClass *dc = DEVICE_CLASS(klass);
> @@ -290,11 +300,12 @@ static void a10_pit_class_init(ObjectClass *klass, void *data)
>  }
>
>  static const TypeInfo a10_pit_info = {
> -    .name = TYPE_AW_A10_PIT,
> -    .parent = TYPE_SYS_BUS_DEVICE,
> -    .instance_size = sizeof(AwA10PITState),
> -    .instance_init = a10_pit_init,
> -    .class_init = a10_pit_class_init,
> +    .name              = TYPE_AW_A10_PIT,
> +    .parent            = TYPE_SYS_BUS_DEVICE,
> +    .instance_size     = sizeof(AwA10PITState),
> +    .instance_init     = a10_pit_init,
> +    .instance_finalize = a10_pit_finalize,
> +    .class_init        = a10_pit_class_init,
>  };

Please don't make unrelated whitespace changes like this in a patch.
We don't line up the assignments in this sort of struct -- this is
deliberate, so that if a new line is added whose field name happens
to be longer than those used already, the patch does not have to
touch all the lines in the struct to maintain the formatting.
Instead you get a readable diff where only the new line changes,
not all the others.

thanks
-- PMM

Re: [PATCH 1/7] allwinner-a10-pit: Use ptimer_free() in the finalize function to avoid memleaks

[Peter Maydell]

On Mon, 14 Dec 2020 at 16:02, Peter Maydell <peter.maydell@linaro.org> wrote:
>
> On Fri, 27 Nov 2020 at 07:19, Gan Qixin <ganqixin@huawei.com> wrote:
> >
> > When running device-introspect-test, a memory leak occurred in the a10_pit_init
> > function, so use ptimer_free() in the finalize function to avoid it.
> >
> > ASAN shows memory leak stack:
> >
> > Indirect leak of 288 byte(s) in 6 object(s) allocated from:
> >     #0 0xffffab97e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
> >     #1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
> >     #2 0xaaabf555db84 in timer_new_full /qemu/include/qemu/timer.h:523
> >     #3 0xaaabf555db84 in timer_new /qemu/include/qemu/timer.h:544
> >     #4 0xaaabf555db84 in timer_new_ns /qemu/include/qemu/timer.h:562
> >     #5 0xaaabf555db84 in ptimer_init /qemu/hw/core/ptimer.c:433
> >     #6 0xaaabf57415e8 in a10_pit_init /qemu/hw/timer/allwinner-a10-pit.c:278
> >     #7 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
> >     #8 0xaaabf633ca04 in object_initialize_child_with_propsv /qemu/qom/object.c:564
> >     #9 0xaaabf633cc08 in object_initialize_child_with_props /qemu/qom/object.c:547
> >     #10 0xaaabf5b94680 in aw_a10_init /qemu/hw/arm/allwinner-a10.c:49
> >     #11 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
> >     #12 0xaaabf633a1e0 in object_new_with_type /qemu/qom/object.c:729
> >
> > Reported-by: Euler Robot <euler.robot@huawei.com>
> > Signed-off-by: Gan Qixin <ganqixin@huawei.com>
> > ---
> > Cc: Beniamino Galvani <b.galvani@gmail.com>
> > ---
> >  hw/timer/allwinner-a10-pit.c | 21 ++++++++++++++++-----
> >  1 file changed, 16 insertions(+), 5 deletions(-)
> >
> > diff --git a/hw/timer/allwinner-a10-pit.c b/hw/timer/allwinner-a10-pit.c
> > index f84fc0ea25..be211983b0 100644
> > --- a/hw/timer/allwinner-a10-pit.c
> > +++ b/hw/timer/allwinner-a10-pit.c
> > @@ -279,6 +279,16 @@ static void a10_pit_init(Object *obj)
> >      }
> >  }
> >
> > +static void a10_pit_finalize(Object *obj)
> > +{
> > +    AwA10PITState *s = AW_A10_PIT(obj);
> > +    int i;
> > +
> > +    for (i = 0; i < AW_A10_PIT_TIMER_NR; i++) {
> > +        ptimer_free(s->timer[i]);
> > +    }
> > +}
> > +
> >  static void a10_pit_class_init(ObjectClass *klass, void *data)
> >  {
> >      DeviceClass *dc = DEVICE_CLASS(klass);
> > @@ -290,11 +300,12 @@ static void a10_pit_class_init(ObjectClass *klass, void *data)
> >  }
> >
> >  static const TypeInfo a10_pit_info = {
> > -    .name = TYPE_AW_A10_PIT,
> > -    .parent = TYPE_SYS_BUS_DEVICE,
> > -    .instance_size = sizeof(AwA10PITState),
> > -    .instance_init = a10_pit_init,
> > -    .class_init = a10_pit_class_init,
> > +    .name              = TYPE_AW_A10_PIT,
> > +    .parent            = TYPE_SYS_BUS_DEVICE,
> > +    .instance_size     = sizeof(AwA10PITState),
> > +    .instance_init     = a10_pit_init,
> > +    .instance_finalize = a10_pit_finalize,
> > +    .class_init        = a10_pit_class_init,
> >  };
>
> Please don't make unrelated whitespace changes like this in a patch.
> We don't line up the assignments in this sort of struct -- this is
> deliberate, so that if a new line is added whose field name happens
> to be longer than those used already, the patch does not have to
> touch all the lines in the struct to maintain the formatting.
> Instead you get a readable diff where only the new line changes,
> not all the others.

Hmm. Having said that I see that the other 6 devices touched
by this series did use the line-up-the-assignments style.
Anyway, the style this device was using is the right one.

thanks
-- PMM

RE: [PATCH 1/7] allwinner-a10-pit: Use ptimer_free() in the finalize function to avoid memleaks

[ganqixin]

> -----Original Message-----
> From: Peter Maydell [mailto:peter.maydell@linaro.org]
> Sent: Tuesday, December 15, 2020 12:20 AM
> To: ganqixin <ganqixin@huawei.com>
> Cc: qemu-arm <qemu-arm@nongnu.org>; QEMU Developers
> <qemu-devel@nongnu.org>; Chenqun (kuhn)
> <kuhn.chenqun@huawei.com>; Zhanghailiang
> <zhang.zhanghailiang@huawei.com>; Euler Robot
> <euler.robot@huawei.com>; Beniamino Galvani <b.galvani@gmail.com>
> Subject: Re: [PATCH 1/7] allwinner-a10-pit: Use ptimer_free() in the
> finalize function to avoid memleaks
> 
> On Mon, 14 Dec 2020 at 16:02, Peter Maydell <peter.maydell@linaro.org>
> wrote:
> >
> > On Fri, 27 Nov 2020 at 07:19, Gan Qixin <ganqixin@huawei.com> wrote:
> > >
> > > When running device-introspect-test, a memory leak occurred in the
> > > a10_pit_init function, so use ptimer_free() in the finalize function to
> avoid it.
> > >
> > > ASAN shows memory leak stack:
> > >
> > > Indirect leak of 288 byte(s) in 6 object(s) allocated from:
> > >     #0 0xffffab97e1f0 in __interceptor_calloc
> (/lib64/libasan.so.5+0xee1f0)
> > >     #1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
> > >     #2 0xaaabf555db84 in timer_new_full
> /qemu/include/qemu/timer.h:523
> > >     #3 0xaaabf555db84 in timer_new
> /qemu/include/qemu/timer.h:544
> > >     #4 0xaaabf555db84 in timer_new_ns
> /qemu/include/qemu/timer.h:562
> > >     #5 0xaaabf555db84 in ptimer_init /qemu/hw/core/ptimer.c:433
> > >     #6 0xaaabf57415e8 in a10_pit_init
> /qemu/hw/timer/allwinner-a10-pit.c:278
> > >     #7 0xaaabf6339f6c in object_initialize_with_type
> /qemu/qom/object.c:515
> > >     #8 0xaaabf633ca04 in object_initialize_child_with_propsv
> /qemu/qom/object.c:564
> > >     #9 0xaaabf633cc08 in object_initialize_child_with_props
> /qemu/qom/object.c:547
> > >     #10 0xaaabf5b94680 in aw_a10_init
> /qemu/hw/arm/allwinner-a10.c:49
> > >     #11 0xaaabf6339f6c in object_initialize_with_type
> /qemu/qom/object.c:515
> > >     #12 0xaaabf633a1e0 in object_new_with_type
> > > /qemu/qom/object.c:729
> > >
> > > Reported-by: Euler Robot <euler.robot@huawei.com>
> > > Signed-off-by: Gan Qixin <ganqixin@huawei.com>
> > > ---
> > > Cc: Beniamino Galvani <b.galvani@gmail.com>
> > > ---
> > >  hw/timer/allwinner-a10-pit.c | 21 ++++++++++++++++-----
> > >  1 file changed, 16 insertions(+), 5 deletions(-)
> > >
> > > diff --git a/hw/timer/allwinner-a10-pit.c
> > > b/hw/timer/allwinner-a10-pit.c index f84fc0ea25..be211983b0
> 100644
> > > --- a/hw/timer/allwinner-a10-pit.c
> > > +++ b/hw/timer/allwinner-a10-pit.c
> > > @@ -279,6 +279,16 @@ static void a10_pit_init(Object *obj)
> > >      }
> > >  }
> > >
> > > +static void a10_pit_finalize(Object *obj) {
> > > +    AwA10PITState *s = AW_A10_PIT(obj);
> > > +    int i;
> > > +
> > > +    for (i = 0; i < AW_A10_PIT_TIMER_NR; i++) {
> > > +        ptimer_free(s->timer[i]);
> > > +    }
> > > +}
> > > +
> > >  static void a10_pit_class_init(ObjectClass *klass, void *data)  {
> > >      DeviceClass *dc = DEVICE_CLASS(klass); @@ -290,11 +300,12
> @@
> > > static void a10_pit_class_init(ObjectClass *klass, void *data)  }
> > >
> > >  static const TypeInfo a10_pit_info = {
> > > -    .name = TYPE_AW_A10_PIT,
> > > -    .parent = TYPE_SYS_BUS_DEVICE,
> > > -    .instance_size = sizeof(AwA10PITState),
> > > -    .instance_init = a10_pit_init,
> > > -    .class_init = a10_pit_class_init,
> > > +    .name              = TYPE_AW_A10_PIT,
> > > +    .parent            = TYPE_SYS_BUS_DEVICE,
> > > +    .instance_size     = sizeof(AwA10PITState),
> > > +    .instance_init     = a10_pit_init,
> > > +    .instance_finalize = a10_pit_finalize,
> > > +    .class_init        = a10_pit_class_init,
> > >  };
> >
> > Please don't make unrelated whitespace changes like this in a patch.
> > We don't line up the assignments in this sort of struct -- this is
> > deliberate, so that if a new line is added whose field name happens to
> > be longer than those used already, the patch does not have to touch
> > all the lines in the struct to maintain the formatting.
> > Instead you get a readable diff where only the new line changes, not
> > all the others.
> 
> Hmm. Having said that I see that the other 6 devices touched by this series
> did use the line-up-the-assignments style.
> Anyway, the style this device was using is the right one.

Thanks for your reply, I will resend this patch. By the way, do we need to keep
the other 6 devices in the same style as this device?

Gan Qixin

Re: [PATCH 1/7] allwinner-a10-pit: Use ptimer_free() in the finalize function to avoid memleaks

[Peter Maydell]

On Tue, 15 Dec 2020 at 02:38, ganqixin <ganqixin@huawei.com> wrote:
>
> > -----Original Message-----
> > From: Peter Maydell [mailto:peter.maydell@linaro.org]
> > Sent: Tuesday, December 15, 2020 12:20 AM
> > To: ganqixin <ganqixin@huawei.com>
> > Cc: qemu-arm <qemu-arm@nongnu.org>; QEMU Developers
> > <qemu-devel@nongnu.org>; Chenqun (kuhn)
> > <kuhn.chenqun@huawei.com>; Zhanghailiang
> > <zhang.zhanghailiang@huawei.com>; Euler Robot
> > <euler.robot@huawei.com>; Beniamino Galvani <b.galvani@gmail.com>
> > Subject: Re: [PATCH 1/7] allwinner-a10-pit: Use ptimer_free() in the
> > finalize function to avoid memleaks
> >
> > On Mon, 14 Dec 2020 at 16:02, Peter Maydell <peter.maydell@linaro.org>
> > wrote:
> > > Please don't make unrelated whitespace changes like this in a patch.
> > > We don't line up the assignments in this sort of struct -- this is
> > > deliberate, so that if a new line is added whose field name happens to
> > > be longer than those used already, the patch does not have to touch
> > > all the lines in the struct to maintain the formatting.
> > > Instead you get a readable diff where only the new line changes, not
> > > all the others.
> >
> > Hmm. Having said that I see that the other 6 devices touched by this series
> > did use the line-up-the-assignments style.
> > Anyway, the style this device was using is the right one.
>
> Thanks for your reply, I will resend this patch. By the way, do we need to keep
> the other 6 devices in the same style as this device?

My suggestion would be that for all these files you just add
the one new line you need to add, and leave the existing lines
in the struct the way they are now (regardless of which style
the file is currently using).

thanks
-- PMM

[PATCH 2/7] digic-timer: Use ptimer_free() in the finalize function to avoid memleaks

[Gan Qixin]

When running device-introspect-test, a memory leak occurred in the digic_timer_init
function, so use ptimer_free() in the finalize function to avoid it.

ASAN shows memory leak stack:

Indirect leak of 288 byte(s) in 3 object(s) allocated from:
    #0 0xffffab97e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
    #1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
    #2 0xaaabf555db78 in ptimer_init /qemu/hw/core/ptimer.c:432
    #3 0xaaabf5b04084 in digic_timer_init /qemu/hw/timer/digic-timer.c:142
    #4 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
    #5 0xaaabf633ca04 in object_initialize_child_with_propsv /qemu/qom/object.c:564
    #6 0xaaabf633cc08 in object_initialize_child_with_props /qemu/qom/object.c:547
    #7 0xaaabf5b40e84 in digic_init /qemu/hw/arm/digic.c:46
    #8 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
    #9 0xaaabf633a1e0 in object_new_with_type /qemu/qom/object.c:729
    #10 0xaaabf6375e40 in qmp_device_list_properties /qemu/qom/qom-qmp-cmds.c:153
    #11 0xaaabf653d8ec in qmp_marshal_device_list_properties /qemu/qapi/qapi-commands-qdev.c:59
    #12 0xaaabf6587d08 in do_qmp_dispatch_bh /qemu/qapi/qmp-dispatch.c:110

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Gan Qixin <ganqixin@huawei.com>
---
Cc: Antony Pavlov <antonynpavlov@gmail.com>
---
 hw/timer/digic-timer.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/hw/timer/digic-timer.c b/hw/timer/digic-timer.c
index 32612228da..86075987fb 100644
--- a/hw/timer/digic-timer.c
+++ b/hw/timer/digic-timer.c
@@ -154,6 +154,13 @@ static void digic_timer_init(Object *obj)
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->iomem);
 }
 
+static void digic_timer_finalize(Object *obj)
+{
+    DigicTimerState *s = DIGIC_TIMER(obj);
+
+    ptimer_free(s->ptimer);
+}
+
 static void digic_timer_class_init(ObjectClass *klass, void *class_data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -163,11 +170,12 @@ static void digic_timer_class_init(ObjectClass *klass, void *class_data)
 }
 
 static const TypeInfo digic_timer_info = {
-    .name = TYPE_DIGIC_TIMER,
-    .parent = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(DigicTimerState),
-    .instance_init = digic_timer_init,
-    .class_init = digic_timer_class_init,
+    .name              = TYPE_DIGIC_TIMER,
+    .parent            = TYPE_SYS_BUS_DEVICE,
+    .instance_size     = sizeof(DigicTimerState),
+    .instance_init     = digic_timer_init,
+    .instance_finalize = digic_timer_finalize,
+    .class_init        = digic_timer_class_init,
 };
 
 static void digic_timer_register_type(void)
-- 
2.23.0

[PATCH 3/7] exynos4210_mct: Use ptimer_free() in the finalize function to avoid memleaks

[Gan Qixin]

When running device-introspect-test, a memory leak occurred in the exynos4210_mct_init
function, so use ptimer_free() in the finalize function to avoid it.

ASAN shows memory leak stack:

Indirect leak of 96 byte(s) in 1 object(s) allocated from:
    #0 0xffffab97e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
    #1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
    #2 0xaaabf555db78 in ptimer_init /qemu/hw/core/ptimer.c:432
    #3 0xaaabf56b01a0 in exynos4210_mct_init /qemu/hw/timer/exynos4210_mct.c:1505
    #4 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
    #5 0xaaabf633a1e0 in object_new_with_type /qemu/qom/object.c:729
    #6 0xaaabf6375e40 in qmp_device_list_properties /qemu/qom/qom-qmp-cmds.c:153
    #7 0xaaabf653d8ec in qmp_marshal_device_list_properties /qemu/qapi/qapi-commands-qdev.c:59
    #8 0xaaabf6587d08 in do_qmp_dispatch_bh /qemu/qapi/qmp-dispatch.c:110
    #9 0xaaabf6552708 in aio_bh_call /qemu/util/async.c:136
    #10 0xaaabf6552708 in aio_bh_poll /qemu/util/async.c:164
    #11 0xaaabf655f19c in aio_dispatch /qemu/util/aio-posix.c:381
    #12 0xaaabf65523f4 in aio_ctx_dispatch /qemu/util/async.c:306

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Gan Qixin <ganqixin@huawei.com>
---
Cc: Igor Mitsyanko <i.mitsyanko@gmail.com>
---
 hw/timer/exynos4210_mct.c | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
index 439053acd2..7172ec425d 100644
--- a/hw/timer/exynos4210_mct.c
+++ b/hw/timer/exynos4210_mct.c
@@ -1530,6 +1530,19 @@ static void exynos4210_mct_init(Object *obj)
     sysbus_init_mmio(dev, &s->iomem);
 }
 
+static void exynos4210_mct_finalize(Object *obj)
+{
+    int i;
+    Exynos4210MCTState *s = EXYNOS4210_MCT(obj);
+
+    ptimer_free(s->g_timer.ptimer_frc);
+
+    for (i = 0; i < 2; i++) {
+        ptimer_free(s->l_timer[i].tick_timer.ptimer_tick);
+        ptimer_free(s->l_timer[i].ptimer_frc);
+    }
+}
+
 static void exynos4210_mct_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -1539,11 +1552,12 @@ static void exynos4210_mct_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo exynos4210_mct_info = {
-    .name          = TYPE_EXYNOS4210_MCT,
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(Exynos4210MCTState),
-    .instance_init = exynos4210_mct_init,
-    .class_init    = exynos4210_mct_class_init,
+    .name              = TYPE_EXYNOS4210_MCT,
+    .parent            = TYPE_SYS_BUS_DEVICE,
+    .instance_size     = sizeof(Exynos4210MCTState),
+    .instance_init     = exynos4210_mct_init,
+    .instance_finalize = exynos4210_mct_finalize,
+    .class_init        = exynos4210_mct_class_init,
 };
 
 static void exynos4210_mct_register_types(void)
-- 
2.23.0

[PATCH 4/7] exynos4210_pwm: Use ptimer_free() in the finalize function to avoid memleaks

[Gan Qixin]

When running device-introspect-test, a memory leak occurred in the exynos4210_pwm_init
function, so use ptimer_free() in the finalize function to avoid it.

ASAN shows memory leak stack:

Indirect leak of 240 byte(s) in 5 object(s) allocated from:
    #0 0xffffab97e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
    #1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
    #2 0xaaabf555db84 in timer_new_full /qemu/include/qemu/timer.h:523
    #3 0xaaabf555db84 in timer_new /qemu/include/qemu/timer.h:544
    #4 0xaaabf555db84 in timer_new_ns /qemu/include/qemu/timer.h:562
    #5 0xaaabf555db84 in ptimer_init /qemu/hw/core/ptimer.c:433
    #6 0xaaabf56a36cc in exynos4210_pwm_init /qemu/hw/timer/exynos4210_pwm.c:401
    #7 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
    #8 0xaaabf633a1e0 in object_new_with_type /qemu/qom/object.c:729
    #9 0xaaabf6375e40 in qmp_device_list_properties /qemu/qom/qom-qmp-cmds.c:153
    #10 0xaaabf653d8ec in qmp_marshal_device_list_properties /qemu/qapi/qapi-commands-qdev.c:59
    #11 0xaaabf6587d08 in do_qmp_dispatch_bh /qemu/qapi/qmp-dispatch.c:110
    #12 0xaaabf6552708 in aio_bh_call /qemu/util/async.c:136

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Gan Qixin <ganqixin@huawei.com>
---
Cc: Igor Mitsyanko <i.mitsyanko@gmail.com>
---
 hw/timer/exynos4210_pwm.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c
index de181428b4..4764164d5e 100644
--- a/hw/timer/exynos4210_pwm.c
+++ b/hw/timer/exynos4210_pwm.c
@@ -410,6 +410,16 @@ static void exynos4210_pwm_init(Object *obj)
     sysbus_init_mmio(dev, &s->iomem);
 }
 
+static void exynos4210_pwm_finalize(Object *obj)
+{
+    Exynos4210PWMState *s = EXYNOS4210_PWM(obj);
+    int i;
+
+    for (i = 0; i < EXYNOS4210_PWM_TIMERS_NUM; i++) {
+        ptimer_free(s->timer[i].ptimer);
+    }
+}
+
 static void exynos4210_pwm_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -419,11 +429,12 @@ static void exynos4210_pwm_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo exynos4210_pwm_info = {
-    .name          = TYPE_EXYNOS4210_PWM,
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(Exynos4210PWMState),
-    .instance_init = exynos4210_pwm_init,
-    .class_init    = exynos4210_pwm_class_init,
+    .name              = TYPE_EXYNOS4210_PWM,
+    .parent            = TYPE_SYS_BUS_DEVICE,
+    .instance_size     = sizeof(Exynos4210PWMState),
+    .instance_init     = exynos4210_pwm_init,
+    .instance_finalize = exynos4210_pwm_finalize,
+    .class_init        = exynos4210_pwm_class_init,
 };
 
 static void exynos4210_pwm_register_types(void)
-- 
2.23.0

[PATCH 5/7] exynos4210_rtc: Use ptimer_free() in the finalize function to avoid memleaks

[Gan Qixin]

When running device-introspect-test, a memory leak occurred in the exynos4210_rtc_init
function, so use ptimer_free() in the finalize function to avoid it.

ASAN shows memory leak stack:

Indirect leak of 96 byte(s) in 1 object(s) allocated from:
    #0 0xffffab97e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
    #1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
    #2 0xaaabf555db78 in ptimer_init /qemu/hw/core/ptimer.c:432
    #3 0xaaabf57b3934 in exynos4210_rtc_init /qemu/hw/rtc/exynos4210_rtc.c:567
    #4 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
    #5 0xaaabf633a1e0 in object_new_with_type /qemu/qom/object.c:729
    #6 0xaaabf6375e40 in qmp_device_list_properties /qemu/qom/qom-qmp-cmds.c:153
    #7 0xaaabf653d8ec in qmp_marshal_device_list_properties /qemu/qapi/qapi-commands-qdev.c:59
    #8 0xaaabf6587d08 in do_qmp_dispatch_bh /qemu/qapi/qmp-dispatch.c:110
    #9 0xaaabf6552708 in aio_bh_call /qemu/util/async.c:136
    #10 0xaaabf6552708 in aio_bh_poll /qemu/util/async.c:164
    #11 0xaaabf655f19c in aio_dispatch /qemu/util/aio-posix.c:381
    #12 0xaaabf65523f4 in aio_ctx_dispatch /qemu/util/async.c:306

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Gan Qixin <ganqixin@huawei.com>
---
Cc: Igor Mitsyanko <i.mitsyanko@gmail.com>
---
 hw/rtc/exynos4210_rtc.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/hw/rtc/exynos4210_rtc.c b/hw/rtc/exynos4210_rtc.c
index 4c97624478..2f667fb010 100644
--- a/hw/rtc/exynos4210_rtc.c
+++ b/hw/rtc/exynos4210_rtc.c
@@ -584,6 +584,14 @@ static void exynos4210_rtc_init(Object *obj)
     sysbus_init_mmio(dev, &s->iomem);
 }
 
+static void exynos4210_rtc_finalize(Object *obj)
+{
+    Exynos4210RTCState *s = EXYNOS4210_RTC(obj);
+
+    ptimer_free(s->ptimer);
+    ptimer_free(s->ptimer_1Hz);
+}
+
 static void exynos4210_rtc_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -593,11 +601,12 @@ static void exynos4210_rtc_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo exynos4210_rtc_info = {
-    .name          = TYPE_EXYNOS4210_RTC,
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(Exynos4210RTCState),
-    .instance_init = exynos4210_rtc_init,
-    .class_init    = exynos4210_rtc_class_init,
+    .name              = TYPE_EXYNOS4210_RTC,
+    .parent            = TYPE_SYS_BUS_DEVICE,
+    .instance_size     = sizeof(Exynos4210RTCState),
+    .instance_init     = exynos4210_rtc_init,
+    .instance_finalize = exynos4210_rtc_finalize,
+    .class_init        = exynos4210_rtc_class_init,
 };
 
 static void exynos4210_rtc_register_types(void)
-- 
2.23.0

[PATCH 6/7] mss-timer: Use ptimer_free() in the finalize function to avoid memleaks

[Gan Qixin]

When running device-introspect-test, a memory leak occurred in the mss_timer_init
function, so use ptimer_free() in the finalize function to avoid it.

ASAN shows memory leak stack:

Indirect leak of 192 byte(s) in 2 object(s) allocated from:
    #0 0xffffab97e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
    #1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
    #2 0xaaabf555db78 in ptimer_init /qemu/hw/core/ptimer.c:432
    #3 0xaaabf58a0010 in mss_timer_init /qemu/hw/timer/mss-timer.c:235
    #4 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
    #5 0xaaabf633ca04 in object_initialize_child_with_propsv /qemu/qom/object.c:564
    #6 0xaaabf633cc08 in object_initialize_child_with_props /qemu/qom/object.c:547
    #7 0xaaabf5b8316c in m2sxxx_soc_initfn /qemu/hw/arm/msf2-soc.c:70
    #8 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
    #9 0xaaabf633a1e0 in object_new_with_type /qemu/qom/object.c:729
    #10 0xaaabf6375e40 in qmp_device_list_properties /qemu/qom/qom-qmp-cmds.c:153
    #11 0xaaabf653d8ec in qmp_marshal_device_list_properties /qemu/qapi/qapi-commands-qdev.c:59
    #12 0xaaabf6587d08 in do_qmp_dispatch_bh /qemu/qapi/qmp-dispatch.c:110

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Gan Qixin <ganqixin@huawei.com>
---
Cc: Subbaraya Sundeep <sundeep.lkml@gmail.com>
---
 hw/timer/mss-timer.c | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/hw/timer/mss-timer.c b/hw/timer/mss-timer.c
index 29943fd744..7c4f3a52da 100644
--- a/hw/timer/mss-timer.c
+++ b/hw/timer/mss-timer.c
@@ -244,6 +244,18 @@ static void mss_timer_init(Object *obj)
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &t->mmio);
 }
 
+static void mss_timer_finalize(Object *obj)
+{
+    MSSTimerState *t = MSS_TIMER(obj);
+    int i;
+
+    for (i = 0; i < NUM_TIMERS; i++) {
+        struct Msf2Timer *st = &t->timers[i];
+
+        ptimer_free(st->ptimer);
+    }
+}
+
 static const VMStateDescription vmstate_timers = {
     .name = "mss-timer-block",
     .version_id = 1,
@@ -283,11 +295,12 @@ static void mss_timer_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo mss_timer_info = {
-    .name          = TYPE_MSS_TIMER,
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(MSSTimerState),
-    .instance_init = mss_timer_init,
-    .class_init    = mss_timer_class_init,
+    .name              = TYPE_MSS_TIMER,
+    .parent            = TYPE_SYS_BUS_DEVICE,
+    .instance_size     = sizeof(MSSTimerState),
+    .instance_init     = mss_timer_init,
+    .instance_finalize = mss_timer_finalize,
+    .class_init        = mss_timer_class_init,
 };
 
 static void mss_timer_register_types(void)
-- 
2.23.0

[PATCH 7/7] musicpal: Use ptimer_free() in the finalize function to avoid memleaks

[Gan Qixin]

When running device-introspect-test, a memory leak occurred in the mv88w8618_pit_init
function, so use ptimer_free() in the finalize function to avoid it.

ASAN shows memory leak stack:

Indirect leak of 192 byte(s) in 4 object(s) allocated from:
    #0 0xffffab97e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
    #1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
    #2 0xaaabf555db84 in timer_new_full /qemu/include/qemu/timer.h:523
    #3 0xaaabf555db84 in timer_new /qemu/include/qemu/timer.h:544
    #4 0xaaabf555db84 in timer_new_ns /qemu/include/qemu/timer.h:562
    #5 0xaaabf555db84 in ptimer_init /qemu/hw/core/ptimer.c:433
    #6 0xaaabf5bb2290 in mv88w8618_timer_init /qemu/hw/arm/musicpal.c:862
    #7 0xaaabf5bb2290 in mv88w8618_pit_init /qemu/hw/arm/musicpal.c:954
    #8 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
    #9 0xaaabf633a1e0 in object_new_with_type /qemu/qom/object.c:729
    #10 0xaaabf6375e40 in qmp_device_list_properties /qemu/qom/qom-qmp-cmds.c:153
    #11 0xaaabf5a95540 in qdev_device_help /qemu/softmmu/qdev-monitor.c:283
    #12 0xaaabf5a96940 in qmp_device_add /qemu/softmmu/qdev-monitor.c:801

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Gan Qixin <ganqixin@huawei.com>
---
Cc: Jan Kiszka <jan.kiszka@web.de>
---
 hw/arm/musicpal.c | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index 458b1cbeb7..0e77082e52 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -959,6 +959,17 @@ static void mv88w8618_pit_init(Object *obj)
     sysbus_init_mmio(dev, &s->iomem);
 }
 
+static void mv88w8618_pit_finalize(Object *obj)
+{
+    SysBusDevice *dev = SYS_BUS_DEVICE(obj);
+    mv88w8618_pit_state *s = MV88W8618_PIT(dev);
+    int i;
+
+    for (i = 0; i < 4; i++) {
+        ptimer_free(s->timer[i].ptimer);
+    }
+}
+
 static const VMStateDescription mv88w8618_timer_vmsd = {
     .name = "timer",
     .version_id = 1,
@@ -990,11 +1001,12 @@ static void mv88w8618_pit_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo mv88w8618_pit_info = {
-    .name          = TYPE_MV88W8618_PIT,
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(mv88w8618_pit_state),
-    .instance_init = mv88w8618_pit_init,
-    .class_init    = mv88w8618_pit_class_init,
+    .name              = TYPE_MV88W8618_PIT,
+    .parent            = TYPE_SYS_BUS_DEVICE,
+    .instance_size     = sizeof(mv88w8618_pit_state),
+    .instance_init     = mv88w8618_pit_init,
+    .instance_finalize = mv88w8618_pit_finalize,
+    .class_init        = mv88w8618_pit_class_init,
 };
 
 /* Flash config register offsets */
-- 
2.23.0

RE: [PATCH 0/7] Fix some memleaks caused by ptimer_init

[ganqixin]

Kindly ping!

Hi all,
  These patches are waiting for review. Could someone help me check them?

Thanks,
Gan Qixin

> -----Original Message-----
> From: ganqixin
> Sent: Friday, November 27, 2020 3:18 PM
> To: qemu-arm@nongnu.org; qemu-devel@nongnu.org
> Cc: peter.maydell@linaro.org; Chenqun (kuhn)
> <kuhn.chenqun@huawei.com>; Zhanghailiang
> <zhang.zhanghailiang@huawei.com>; ganqixin <ganqixin@huawei.com>
> Subject: [PATCH 0/7] Fix some memleaks caused by ptimer_init
> 
> Hi all,
> 
> When running device-introspect-test, I found some memory leaks caused
> by ptimer_init in the init function, so I released it in the finalize function.
> 
> 
> Gan Qixin (7):
>   allwinner-a10-pit: Use ptimer_free() in the finalize function to avoid
>     memleaks
>   digic-timer: Use ptimer_free() in the finalize function to avoid
>     memleaks
>   exynos4210_mct: Use ptimer_free() in the finalize function to avoid
>     memleaks
>   exynos4210_pwm: Use ptimer_free() in the finalize function to avoid
>     memleaks
>   exynos4210_rtc: Use ptimer_free() in the finalize function to avoid
>     memleaks
>   mss-timer: Use ptimer_free() in the finalize function to avoid
>     memleaks
>   musicpal: Use ptimer_free() in the finalize function to avoid memleaks
> 
>  hw/arm/musicpal.c            | 22 +++++++++++++++++-----
>  hw/rtc/exynos4210_rtc.c      | 19 ++++++++++++++-----
>  hw/timer/allwinner-a10-pit.c | 21 ++++++++++++++++-----
>  hw/timer/digic-timer.c       | 18 +++++++++++++-----
>  hw/timer/exynos4210_mct.c    | 24 +++++++++++++++++++-----
>  hw/timer/exynos4210_pwm.c    | 21 ++++++++++++++++-----
>  hw/timer/mss-timer.c         | 23 ++++++++++++++++++-----
>  7 files changed, 113 insertions(+), 35 deletions(-)
> 
> --
> 2.23.0