hw/arm/sbsa-ref: free unrealized flash devices on finalization
Flash devices are created with qdev_new() in instance_init and added as children, but the initial reference from qdev_new() is only dropped by sysbus_realize_and_unref() during machine init. When the machine object is destroyed before realization (e.g. during qtest device introspection), the flash devices leak. Fixes: e9fdf453240e ("hw/arm: Add arm SBSA reference machine, devices part") Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Marc-André Lureau committed
Apr 27, 2026 at 16:09 UTC
552236be1a44bccc4f88957e9105e9f756795870
1 file changed
+12
hw/arm/sbsa-ref.c
+12
@@ -892,6 +892,17 @@ static void sbsa_ref_instance_init(Object *obj)
892
sbsa_flash_create(sms);
893
}
894
895
+static void sbsa_ref_instance_finalize(Object *obj)
896
+{
897
+ SBSAMachineState *sms = SBSA_MACHINE(obj);
898
+
899
+ for (int i = 0; i < ARRAY_SIZE(sms->flash); i++) {
900
+ if (sms->flash[i] && !qdev_is_realized(DEVICE(sms->flash[i]))) {
901
+ object_unref(OBJECT(sms->flash[i]));
902
+ }
903
+ }
904
+}
905
+
906
static void sbsa_ref_class_init(ObjectClass *oc, const void *data)
907
{
908
MachineClass *mc = MACHINE_CLASS(oc);
@@ -930,6 +941,7 @@ static const TypeInfo sbsa_ref_info = {
941
.name = TYPE_SBSA_MACHINE,
942
.parent = TYPE_MACHINE,
943
.instance_init = sbsa_ref_instance_init,
944
+ .instance_finalize = sbsa_ref_instance_finalize,
945
.class_init = sbsa_ref_class_init,
946
.instance_size = sizeof(SBSAMachineState),
947
.interfaces = aarch64_machine_interfaces,