[PATCH 0/3]hw: Fixs memleak of fdevice tree blob

[PATCH 0/3]hw: Fixs memleak of fdevice tree blob

[kuhn.chenqun]

From: Chen Qun <kuhn.chenqun@huawei.com>

The device tree blob returned by load_device_tree is malloced.
We should free it after cpu_physical_memory_write().Otherwise,
if we repeatedly call 'system_reset',it will repeatedly load fdt,
so there are many memleaks.

Paolo Bonzini :
https://lists.gnu.org/archive/html/qemu-devel/2019-10/msg00129.html

Pan Nengyuan:
https://lists.gnu.org/archive/html/qemu-devel/2020-02/msg03594.html

After searching the device code, I found three similar issues.
This series fixes the last three.

Chen Qun (3):
  hw/nios2:fix leak of fdevice tree blob
  hw/ppc/virtex_ml507:fix leak of fdevice tree blob
  hw/xtensa/xtfpga:fix leak of fdevice tree blob

 hw/nios2/boot.c       | 1 +
 hw/ppc/virtex_ml507.c | 1 +
 hw/xtensa/xtfpga.c    | 1 +
 3 files changed, 3 insertions(+)

-- 
2.23.0

[PATCH 1/3] hw/nios2:fix leak of fdevice tree blob

[kuhn.chenqun]

From: Chen Qun <kuhn.chenqun@huawei.com>

The device tree blob returned by load_device_tree is malloced.
We should free it after cpu_physical_memory_write().

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com>
---
 hw/nios2/boot.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/nios2/boot.c b/hw/nios2/boot.c
index 46b8349876..88224aa84c 100644
--- a/hw/nios2/boot.c
+++ b/hw/nios2/boot.c
@@ -109,6 +109,7 @@ static int nios2_load_dtb(struct nios2_boot_info bi, const uint32_t ramsize,
     }
 
     cpu_physical_memory_write(bi.fdt, fdt, fdt_size);
+    g_free(fdt);
     return fdt_size;
 }
 
-- 
2.23.0

[PATCH 2/3] hw/ppc/virtex_ml507:fix leak of fdevice tree blob

[kuhn.chenqun]

From: Chen Qun <kuhn.chenqun@huawei.com>

The device tree blob returned by load_device_tree is malloced.
We should free it after cpu_physical_memory_write().

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com>
---
 hw/ppc/virtex_ml507.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/ppc/virtex_ml507.c b/hw/ppc/virtex_ml507.c
index 91dd00ee91..4eef70069f 100644
--- a/hw/ppc/virtex_ml507.c
+++ b/hw/ppc/virtex_ml507.c
@@ -188,6 +188,7 @@ static int xilinx_load_device_tree(hwaddr addr,
     if (r < 0)
         fprintf(stderr, "couldn't set /chosen/bootargs\n");
     cpu_physical_memory_write(addr, fdt, fdt_size);
+    g_free(fdt);
     return fdt_size;
 }
 
-- 
2.23.0

[PATCH 3/3] hw/xtensa/xtfpga:fix leak of fdevice tree blob

[kuhn.chenqun]

From: Chen Qun <kuhn.chenqun@huawei.com>

The device tree blob returned by load_device_tree is malloced.
We should free it after cpu_physical_memory_write().

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com>
---
 hw/xtensa/xtfpga.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/xtensa/xtfpga.c b/hw/xtensa/xtfpga.c
index 8e2dd1327a..60ccc74f5f 100644
--- a/hw/xtensa/xtfpga.c
+++ b/hw/xtensa/xtfpga.c
@@ -380,6 +380,7 @@ static void xtfpga_init(const XtfpgaBoardDesc *board, MachineState *machine)
             cur_tagptr = put_tag(cur_tagptr, BP_TAG_FDT,
                                  sizeof(dtb_addr), &dtb_addr);
             cur_lowmem = QEMU_ALIGN_UP(cur_lowmem + fdt_size, 4 * KiB);
+            g_free(fdt);
         }
 #else
         if (dtb_filename) {
-- 
2.23.0

RE: [PATCH 0/3]hw: Fixs memleak of fdevice tree blob

[Chenqun (kuhn)]

>-----Original Message-----
>From: Chenqun (kuhn)
>Sent: Tuesday, February 18, 2020 5:12 PM
>To: qemu-devel@nongnu.org; qemu-ppc@nongnu.org; jcmvbkbc@gmail.com;
>crwulff@gmail.com; marex@denx.de; edgar.iglesias@gmail.com;
>david@gibson.dropbear.id.au
>Cc: Zhanghailiang <zhang.zhanghailiang@huawei.com>; qemu-
>trivial@nongnu.org; pbonzini@redhat.com; Pannengyuan
><pannengyuan@huawei.com>; Chenqun (kuhn)
><kuhn.chenqun@huawei.com>
>Subject: [PATCH 0/3]hw: Fixs memleak of fdevice tree blob
>
>From: Chen Qun <kuhn.chenqun@huawei.com>
>
Hi all, after reviewing various patches from Pan Nengyuan fix ppc-e500
fdt memleaks, I search for related content and found Paolo Bonzini's
similarly patchs. (sorry, this description is missing here because of this patch format.)

>The device tree blob returned by load_device_tree is malloced.
>We should free it after cpu_physical_memory_write().Otherwise,
>if we repeatedly call 'system_reset',it will repeatedly load fdt, so there are
>many memleaks.
>
>Paolo Bonzini :
>https://lists.gnu.org/archive/html/qemu-devel/2019-10/msg00129.html
>
>Pan Nengyuan:
>https://lists.gnu.org/archive/html/qemu-devel/2020-02/msg03594.html
>
>After searching the device code, I found three similar issues.
>This series fixes the last three.
>
>Chen Qun (3):
>  hw/nios2:fix leak of fdevice tree blob
>  hw/ppc/virtex_ml507:fix leak of fdevice tree blob
>  hw/xtensa/xtfpga:fix leak of fdevice tree blob
>
> hw/nios2/boot.c       | 1 +
> hw/ppc/virtex_ml507.c | 1 +
> hw/xtensa/xtfpga.c    | 1 +
> 3 files changed, 3 insertions(+)
>
>--
>2.23.0
>

Re: [PATCH 3/3] hw/xtensa/xtfpga:fix leak of fdevice tree blob

[Max Filippov]

On Tue, Feb 18, 2020 at 1:14 AM <kuhn.chenqun@huawei.com> wrote:
>
> From: Chen Qun <kuhn.chenqun@huawei.com>
>
> The device tree blob returned by load_device_tree is malloced.
> We should free it after cpu_physical_memory_write().
>
> Reported-by: Euler Robot <euler.robot@huawei.com>
> Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com>
> ---
>  hw/xtensa/xtfpga.c | 1 +
>  1 file changed, 1 insertion(+)

Acked-by: Max Filippov <jcmvbkbc@gmail.com>

-- 
Thanks.
-- Max

Re: [PATCH 2/3] hw/ppc/virtex_ml507:fix leak of fdevice tree blob

[David Gibson]

[-- Attachment #1: Type: text/plain, Size: 1119 bytes --]

On Tue, Feb 18, 2020 at 05:11:53PM +0800, kuhn.chenqun@huawei.com wrote:
> From: Chen Qun <kuhn.chenqun@huawei.com>
> 
> The device tree blob returned by load_device_tree is malloced.
> We should free it after cpu_physical_memory_write().
> 
> Reported-by: Euler Robot <euler.robot@huawei.com>
> Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com>

I've applied this patch to my ppc-for-5.0 staging tree.

> ---
>  hw/ppc/virtex_ml507.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/hw/ppc/virtex_ml507.c b/hw/ppc/virtex_ml507.c
> index 91dd00ee91..4eef70069f 100644
> --- a/hw/ppc/virtex_ml507.c
> +++ b/hw/ppc/virtex_ml507.c
> @@ -188,6 +188,7 @@ static int xilinx_load_device_tree(hwaddr addr,
>      if (r < 0)
>          fprintf(stderr, "couldn't set /chosen/bootargs\n");
>      cpu_physical_memory_write(addr, fdt, fdt_size);
> +    g_free(fdt);
>      return fdt_size;
>  }
>  

-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH 3/3] hw/xtensa/xtfpga:fix leak of fdevice tree blob

[Laurent Vivier]

Le 18/02/2020 à 10:11, kuhn.chenqun@huawei.com a écrit :
> From: Chen Qun <kuhn.chenqun@huawei.com>
> 
> The device tree blob returned by load_device_tree is malloced.
> We should free it after cpu_physical_memory_write().
> 
> Reported-by: Euler Robot <euler.robot@huawei.com>
> Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com>
> ---
>  hw/xtensa/xtfpga.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/hw/xtensa/xtfpga.c b/hw/xtensa/xtfpga.c
> index 8e2dd1327a..60ccc74f5f 100644
> --- a/hw/xtensa/xtfpga.c
> +++ b/hw/xtensa/xtfpga.c
> @@ -380,6 +380,7 @@ static void xtfpga_init(const XtfpgaBoardDesc *board, MachineState *machine)
>              cur_tagptr = put_tag(cur_tagptr, BP_TAG_FDT,
>                                   sizeof(dtb_addr), &dtb_addr);
>              cur_lowmem = QEMU_ALIGN_UP(cur_lowmem + fdt_size, 4 * KiB);
> +            g_free(fdt);
>          }
>  #else
>          if (dtb_filename) {
> 

Reviewed-by: Laurent Vivier <laurent@vivier.eu>

Re: [PATCH 1/3] hw/nios2:fix leak of fdevice tree blob

[Laurent Vivier]

Le 18/02/2020 à 10:11, kuhn.chenqun@huawei.com a écrit :
> From: Chen Qun <kuhn.chenqun@huawei.com>
> 
> The device tree blob returned by load_device_tree is malloced.
> We should free it after cpu_physical_memory_write().
> 
> Reported-by: Euler Robot <euler.robot@huawei.com>
> Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com>
> ---
>  hw/nios2/boot.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/hw/nios2/boot.c b/hw/nios2/boot.c
> index 46b8349876..88224aa84c 100644
> --- a/hw/nios2/boot.c
> +++ b/hw/nios2/boot.c
> @@ -109,6 +109,7 @@ static int nios2_load_dtb(struct nios2_boot_info bi, const uint32_t ramsize,
>      }
>  
>      cpu_physical_memory_write(bi.fdt, fdt, fdt_size);
> +    g_free(fdt);
>      return fdt_size;
>  }
>  
> 

Applied to my trivial-patches branch.

Thanks,
Laurent