Re: [PATCH v2 1/6] hw/cxl: fix timer leak in cxl_destroy_cci()

On 23/7/26 03:16, Junjie Cao wrote:
> cxl_init_cci() allocates a QEMUTimer via timer_new_ms() but
> cxl_destroy_cci() never frees it.  This leaks a timer object on every
> device exit path and, more critically, on every device reset cycle since
> the secondary CCIs (vdm_fm_owned_ld_mctp_cci, ld0_cci) are destroyed
> and re-initialized each time ct3d_reset() runs.
> 
> Tear the CCI down in the reverse of cxl_init_cci()'s setup order:
> destroy the mutex, then free the timer.  timer_free() cancels any
> pending expiry via timer_del() internally and tolerates a NULL pointer;
> clear the field afterwards so that a repeated timer_free() on the same
> CCI is a safe no-op.
> (The function as a whole is still not idempotent: qemu_mutex_destroy()
> asserts on an already-destroyed mutex.  Callers must not invoke
> cxl_destroy_cci() twice; the .initialized guard added in the next patch
> enforces that.)
> 
> Fixes: 98cbac128f1c ("hw/cxl: Support aborting background commands")
> Cc: [email protected]
> Signed-off-by: Junjie Cao <[email protected]>
> ---
>   hw/cxl/cxl-mailbox-utils.c | 2 ++
>   1 file changed, 2 insertions(+)

Reviewed-by: Philippe Mathieu-Daudé <[email protected]>