hw/ide: fix memory leak from qemu_allocate_irqs()

qemu_allocate_irqs would return an array of irqs, not store the allocated
array pointer, and subsequently leak it.

Signed-off-by: Kaifeng Zhu <kaifeng.zhu@citrix.com>
(defects not identified by Coverity Scan)
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>

diff --git a/hw/ide.c b/hw/ide.c
index 36366116f5f335a129754bf0ada834a6239bd7db..4c30edd2748e2c3c733fbbf358dffc28c1e4d34c 100644 (file)
--- a/hw/ide.c
+++ b/hw/ide.c
@@ -4793,7 +4793,7 @@ struct pcmcia_card_s *dscm1xxxx_init(BlockDriverState *bdrv)
     md->card.cis = dscm1xxxx_cis;
     md->card.cis_len = sizeof(dscm1xxxx_cis);
 
-    ide_init2(md->ide, bdrv, 0, qemu_allocate_irqs(md_set_irq, md, 1)[0]);
+    ide_init2(md->ide, bdrv, 0, qemu_allocate_irq(md_set_irq, md));
     md->ide->is_cf = 1;
     md->ide->mdata_size = METADATA_SIZE;
     md->ide->mdata_storage = (uint8_t *) qemu_mallocz(METADATA_SIZE);

diff --git a/hw/irq.c b/hw/irq.c
index 7703f62c6c486b7787985e4f17cc4c75cbef31f3..c7c4864622b05b45b054f8183dbcd0bd6a895dd4 100644 (file)
--- a/hw/irq.c
+++ b/hw/irq.c
@@ -38,6 +38,22 @@ void qemu_set_irq(qemu_irq irq, int level)
     irq->handler(irq->opaque, irq->n, level);
 }
 
+qemu_irq qemu_allocate_irq(qemu_irq_handler handler, void *opaque)
+{
+    struct IRQState *irq;
+
+    irq = (struct IRQState *)qemu_mallocz(sizeof(struct IRQState));
+    irq->handler = handler;
+    irq->opaque = opaque;
+    irq->n = 0;
+    return irq;
+}
+
+void qemu_free_irq(qemu_irq irq)
+{
+    qemu_free(irq);
+}
+
 qemu_irq *qemu_allocate_irqs(qemu_irq_handler handler, void *opaque, int n)
 {
     qemu_irq *s;
@@ -73,5 +89,5 @@ qemu_irq qemu_irq_invert(qemu_irq irq)
 {
     /* The default state for IRQs is low, so raise the output now.  */
     qemu_irq_raise(irq);
-    return qemu_allocate_irqs(qemu_notirq, irq, 1)[0];
+    return qemu_allocate_irq(qemu_notirq, irq);
 }

diff --git a/hw/irq.h b/hw/irq.h
index 5daae449096a652739f8ff934c364ca5a7b4932d..da34ae3ea2e4497c0a074973c50ec21389ee8a2f 100644 (file)
--- a/hw/irq.h
+++ b/hw/irq.h
@@ -25,6 +25,10 @@ static inline void qemu_irq_pulse(qemu_irq irq)
     qemu_set_irq(irq, 0);
 }
 
+/* Returns one IRQ.  */
+qemu_irq qemu_allocate_irq(qemu_irq_handler handler, void *opaque);
+void qemu_free_irq(qemu_irq irq);
+
 /* Returns an array of N IRQs.  */
 qemu_irq *qemu_allocate_irqs(qemu_irq_handler handler, void *opaque, int n);
 void qemu_free_irqs(qemu_irq *s);