@samitouri / QOSamiQemu / commits / b38859be76

hw/isa/piix: Embed i8259 irq in device state instead of allocating

The pci_piix_realize() function's use of qemu_allocate_irqs() results in a memory leak: Direct leak of 8 byte(s) in 1 object(s) allocated from: #0 0x61045c7a1a43 in malloc (/home/pm215/qemu/build/san/qemu-system-mips+0x16f8a43) (BuildId: aa43d3865e0f1991b1fc04422b5570fe522b6fa7) #1 0x724cc3095ac9 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x62ac9) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3) #2 0x61045db72134 in qemu_extend_irqs /home/pm215/qemu/build/san/../../hw/core/irq.c:77:51 #3 0x61045cd7bf49 in pci_piix_realize /home/pm215/qemu/build/san/../../hw/isa/piix.c:318:35 #4 0x61045cf4533e in pci_qdev_realize /home/pm215/qemu/build/san/../../hw/pci/pci.c:2308:9 #5 0x61045db6cbca in device_set_realized /home/pm215/qemu/build/san/../../hw/core/qdev.c:523:13 #6 0x61045db86bd9 in property_set_bool /home/pm215/qemu/build/san/../../qom/object.c:2376:5 #7 0x61045db81c5e in object_property_set /home/pm215/qemu/build/san/../../qom/object.c:1450:5 #8 0x61045db8e2fc in object_property_set_qobject /home/pm215/qemu/build/san/../../qom/qom-qobject.c:28:10 #9 0x61045db8258f in object_property_set_bool /home/pm215/qemu/build/san/../../qom/object.c:1520:15 #10 0x61045db687aa in qdev_realize_and_unref /home/pm215/qemu/build/san/../../hw/core/qdev.c:283:11 #11 0x61045d892e21 in mips_malta_init /home/pm215/qemu/build/san/../../hw/mips/malta.c:1239:5 (The i386 PC sets the has-pic property to 'false', so this only affects the MIPS Malta board.) Fix this by embedding the i8259 irq in the device state instead of allocating it. This is a similar fix to the one we used for vt82c686 in commit 2225dc562a93dc, except that we use qemu_init_irq_child() instead of qemu_init_irq(). The behaviour is identical except that the _child() version avoids what would be a leak if we ever unrealized the device. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Bernhard Beschow <shentey@gmail.com> Message-id: 20260309171258.1905205-1-peter.maydell@linaro.org

Peter Maydell committed Mar 23, 2026 at 09:51 UTC b38859be76abf4d49f81f36317e6e37ab93121f0
2 files changed +9 -5
hw/isa/piix.c
+6 -5
@@ -315,12 +315,13 @@ static void pci_piix_realize(PCIDevice *dev, const char *uhci_type,
315
316 /* PIC */
317 if (d->has_pic) {
318 - qemu_irq *i8259_out_irq = qemu_allocate_irqs(piix_request_i8259_irq, d,
319 - 1);
320 - qemu_irq *i8259 = i8259_init(isa_bus, *i8259_out_irq);
321 - size_t i;
318 + qemu_irq *i8259;
319
323 - for (i = 0; i < ISA_NUM_IRQS; i++) {
320 + qemu_init_irq_child(OBJECT(dev), "i8259-irq", &d->i8259_irq,
321 + piix_request_i8259_irq, d, 0);
322 + i8259 = i8259_init(isa_bus, &d->i8259_irq);
323 +
324 + for (size_t i = 0; i < ISA_NUM_IRQS; i++) {
325 d->isa_irqs_in[i] = i8259[i];
326 }
327
include/hw/southbridge/piix.h
+3
@@ -17,6 +17,7 @@
17 #include "hw/ide/pci.h"
18 #include "hw/rtc/mc146818rtc.h"
19 #include "hw/usb/hcd-uhci.h"
20 +#include "hw/core/irq.h"
21
22 /* PIRQRC[A:D]: PIRQx Route Control Registers */
23 #define PIIX_PIRQCA 0x60
@@ -52,6 +53,8 @@ struct PIIXState {
53 qemu_irq cpu_intr;
54 qemu_irq isa_irqs_in[ISA_NUM_IRQS];
55
56 + IRQState i8259_irq;
57 +
58 /* This member isn't used. Just for save/load compatibility */
59 int32_t pci_irq_levels_vmstate[PIIX_NUM_PIRQS];
60