From: Peter Xu <peterx@redhat.com>
Date: Thu, 23 Apr 2026 18:32:11 +0000 (-0400)
Subject: system/ioport: Fix qom-list-properties crash on portio list obj
X-Git-Tag: v11.1.0-rc0~124^2~18
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=010a30d8a48355333401a97288aef2a79f2d3cb6;p=thirdparty%2Fqemu.git

system/ioport: Fix qom-list-properties crash on portio list obj

Currently qom-list-properties QMP command will crash when querying the
portio list MR object.  It's because its finalize() assumes full
initialization done in portio_list_add_1().

Provide a simple fix for now to avoid the crash.  There is chance for a
longer term fix, ideally MR should be initialized in instance_init().

However that'll need more work, and that should also be done with cleaning
the hard-coded MR operations in portio_list_add_1().  To be explored.

Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Link: https://lore.kernel.org/r/87a4uvw066.fsf@pond.sub.org
Reported-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Peter Xu <peterx@redhat.com>
---

diff --git a/system/ioport.c b/system/ioport.c
index 9209bff2eab..1a0e01fd06b 100644
--- a/system/ioport.c
+++ b/system/ioport.c
@@ -346,8 +346,15 @@ static void memory_region_portio_list_finalize(Object *obj)
 {
     MemoryRegionPortioList *mrpio = MEMORY_REGION_PORTIO_LIST(obj);
 
-    object_unref(&mrpio->mr);
-    g_free(mrpio->ports);
+    /*
+     * This check makes sure any random object_new() (without doing the
+     * rest inits in portio_list_add_1()) will not crash when finalizing.
+     * One example is QMP command qom-list-properties.
+     */
+    if (mrpio->ports) {
+        object_unref(&mrpio->mr);
+        g_free(mrpio->ports);
+    }
 }
 
 static const TypeInfo memory_region_portio_list_info = {