Re: [PATCH 1/6] hw/cxl: fix timer leak in cxl_destroy_cci()

On Fri, 26 Jun 2026 14:21:44 +0800
Junjie Cao <[email protected]> wrote:

> cxl_init_cci() allocates a QEMUTimer via timer_new_ms() but
> cxl_destroy_cci() never frees it.  This leaks a timer object on every
> device exit path and, more critically, on every device reset cycle since
> the secondary CCIs (vdm_fm_owned_ld_mctp_cci, ld0_cci) are destroyed
> and re-initialized each time ct3d_reset() runs.
> 
> Free the timer with timer_free(), which cancels any pending expiry via
> timer_del() internally and tolerates a NULL pointer, then clear the
> field so that a repeated timer_free() on the same CCI is a safe no-op.
> (The function as a whole is not idempotent: it also calls
> qemu_mutex_destroy(), which asserts on an already-destroyed mutex.
> Callers must not invoke cxl_destroy_cci() twice; the .initialized guard
> added in the next patch enforces that.)
> 
> Fixes: 98cbac128f1c ("hw/cxl: Support aborting background commands")
> Cc: [email protected]
> Signed-off-by: Junjie Cao <[email protected]>
Hi. Sorry for delay on catching up with these.

One minor thing inline - otherwise looks good to me.

Jonathan

> ---
>  hw/cxl/cxl-mailbox-utils.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
> index 20e0b7e476..18a455e89c 100644
> --- a/hw/cxl/cxl-mailbox-utils.c
> +++ b/hw/cxl/cxl-mailbox-utils.c
> @@ -4770,6 +4770,8 @@ void cxl_init_cci(CXLCCI *cci, size_t payload_max)
>  
>  void cxl_destroy_cci(CXLCCI *cci)
>  {
> +    timer_free(cci->bg.timer);
> +    cci->bg.timer = NULL;
Can we do this in reverse of the cxl_init_cci() ordering?   That would
put these after the qemu_mutex_destroy()

>      qemu_mutex_destroy(&cci->bg.lock);
>      cci->initialized = false;
>  }