@samitouri / QOSamiQemu / commits / 49f7a6ac5d

hw/fsi: move OPBus address space init to realize

The OPBus instance_init initializes an AddressSpace, registering it in the global address_spaces list. When a bare OPBus object is created and destroyed (e.g. by qom-tests), there is no finalize to remove the stale entry, leading to a heap-use-after-free when a subsequent flatviews_reset iterates the list. Move address_space_init to the bus realize callback and add the corresponding address_space_destroy in unrealize, following the NubusBus pattern. Also fix the memory_region_init owner from NULL to the OPBus object, so the MR is properly parented instead of dangling under the "unattached" container. Fixes: eb04c35da2c0 ("hw/fsi: Aspeed APB2OPB & On-chip peripheral bus") Reviewed-by: Cédric Le Goater <clg@redhat.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

Marc-André Lureau committed Apr 27, 2026 at 15:51 UTC 49f7a6ac5d01e79e287ce7fef5f68f3490a8f218

1 file changed +23 -1

hw/fsi/aspeed_apb2opb.c

+23 -1

@@ -348,15 +348,37 @@ static void fsi_opb_init(Object *o)

348 {

349 OPBus *opb = OP_BUS(o);

350

351 - memory_region_init(&opb->mr, 0, TYPE_FSI_OPB, UINT32_MAX);

351 + memory_region_init(&opb->mr, o, TYPE_FSI_OPB, UINT32_MAX);

352 +}

353 +

354 +static void fsi_opb_realize(BusState *bus, Error **errp)

355 +{

356 + OPBus *opb = OP_BUS(bus);

357 +

358 address_space_init(&opb->as, &opb->mr, TYPE_FSI_OPB);

359 }

360

361 +static void fsi_opb_unrealize(BusState *bus)

362 +{

363 + OPBus *opb = OP_BUS(bus);

364 +

365 + address_space_destroy(&opb->as);

366 +}

367 +

368 +static void fsi_opb_class_init(ObjectClass *klass, const void *data)

369 +{

370 + BusClass *bc = BUS_CLASS(klass);

371 +

372 + bc->realize = fsi_opb_realize;

373 + bc->unrealize = fsi_opb_unrealize;

374 +}

375 +

376 static const TypeInfo opb_info = {

377 .name = TYPE_OP_BUS,

378 .parent = TYPE_BUS,

379 .instance_init = fsi_opb_init,

380 .instance_size = sizeof(OPBus),

381 + .class_init = fsi_opb_class_init,

382 };

383

384 static void fsi_opb_register_types(void)