diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2015-10-01 10:59:51 +0200 |
|---|---|---|
| committer | Markus Armbruster <armbru@redhat.com> | 2015-10-09 15:25:56 +0200 |
| commit | 81e0ab48dda611e9571dc2e166840205a4208567 (patch) | |
| tree | 9d061d1adabcf6b32802be14630c38e59a818f21 /hw/display | |
| parent | 2e2b8eb70fdb7dfbec39f3a19b20f9a73f2f813e (diff) | |
| download | qemu-81e0ab48dda611e9571dc2e166840205a4208567.tar.gz qemu-81e0ab48dda611e9571dc2e166840205a4208567.tar.bz2 qemu-81e0ab48dda611e9571dc2e166840205a4208567.zip | |
hw: do not pass NULL to memory_region_init from instance_init
This causes the region to outlive the object, because it attaches the
region to /machine. This is not nice for the "realize" method, but
much worse for "instance_init" because it can cause dangling pointers
after a simple object_new/object_unref pair.
Reported-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <1443689999-12182-3-git-send-email-armbru@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Diffstat (limited to 'hw/display')
| -rw-r--r-- | hw/display/cg3.c | 4 | ||||
| -rw-r--r-- | hw/display/tcx.c | 2 |
2 files changed, 3 insertions, 3 deletions
diff --git a/hw/display/cg3.c b/hw/display/cg3.c index d2a0d97320..e309fbe92e 100644 --- a/hw/display/cg3.c +++ b/hw/display/cg3.c @@ -280,12 +280,12 @@ static void cg3_initfn(Object *obj) SysBusDevice *sbd = SYS_BUS_DEVICE(obj); CG3State *s = CG3(obj); - memory_region_init_ram(&s->rom, NULL, "cg3.prom", FCODE_MAX_ROM_SIZE, + memory_region_init_ram(&s->rom, obj, "cg3.prom", FCODE_MAX_ROM_SIZE, &error_fatal); memory_region_set_readonly(&s->rom, true); sysbus_init_mmio(sbd, &s->rom); - memory_region_init_io(&s->reg, NULL, &cg3_reg_ops, s, "cg3.reg", + memory_region_init_io(&s->reg, obj, &cg3_reg_ops, s, "cg3.reg", CG3_REG_SIZE); sysbus_init_mmio(sbd, &s->reg); } diff --git a/hw/display/tcx.c b/hw/display/tcx.c index 463580094a..bf119bc89a 100644 --- a/hw/display/tcx.c +++ b/hw/display/tcx.c @@ -944,7 +944,7 @@ static void tcx_initfn(Object *obj) SysBusDevice *sbd = SYS_BUS_DEVICE(obj); TCXState *s = TCX(obj); - memory_region_init_ram(&s->rom, NULL, "tcx.prom", FCODE_MAX_ROM_SIZE, + memory_region_init_ram(&s->rom, OBJECT(s), "tcx.prom", FCODE_MAX_ROM_SIZE, &error_fatal); memory_region_set_readonly(&s->rom, true); sysbus_init_mmio(sbd, &s->rom); |