Running qemu-system-aarch64 -M virt -nographic and terminating it will
result in a LeakSanitizer error due to remaining queued CPU work so
free it.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
---
 include/hw/core/cpu.h |  6 ++++++
 cpu-common.c          | 11 +++++++++++
 hw/core/cpu-common.c  |  1 +
 3 files changed, 18 insertions(+)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index a2c8536943f7..8e6466c1ddab 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -1000,6 +1000,12 @@ void cpu_resume(CPUState *cpu);
  */
 void cpu_remove_sync(CPUState *cpu);
 
+/**
+ * free_queued_cpu_work() - free all items on CPU work queue
+ * @cpu: The CPU which work queue to free.
+ */
+void free_queued_cpu_work(CPUState *cpu);
+
 /**
  * process_queued_cpu_work() - process all items on CPU work queue
  * @cpu: The CPU which work queue to process.
diff --git a/cpu-common.c b/cpu-common.c
index ce78273af597..7ae136f98ca7 100644
--- a/cpu-common.c
+++ b/cpu-common.c
@@ -331,6 +331,17 @@ void async_safe_run_on_cpu(CPUState *cpu, run_on_cpu_func func,
     queue_work_on_cpu(cpu, wi);
 }
 
+void free_queued_cpu_work(CPUState *cpu)
+{
+    while (!QSIMPLEQ_EMPTY(&cpu->work_list)) {
+        struct qemu_work_item *wi = QSIMPLEQ_FIRST(&cpu->work_list);
+        QSIMPLEQ_REMOVE_HEAD(&cpu->work_list, node);
+        if (wi->free) {
+            g_free(wi);
+        }
+    }
+}
+
 void process_queued_cpu_work(CPUState *cpu)
 {
     struct qemu_work_item *wi;
diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
index b19e1fdacf22..d2e3e4570ab7 100644
--- a/hw/core/cpu-common.c
+++ b/hw/core/cpu-common.c
@@ -281,6 +281,7 @@ static void cpu_common_finalize(Object *obj)
         g_free(cpu->plugin_state);
     }
 #endif
+    free_queued_cpu_work(cpu);
     g_array_free(cpu->gdb_regs, TRUE);
     qemu_lockcnt_destroy(&cpu->in_ioctl_lock);
     qemu_mutex_destroy(&cpu->work_mutex);

---
base-commit: f2cb4026fccfe073f84a4b440e41d3ed0c3134f6
change-id: 20240714-cpu-c4d28823b4c2

Best regards,
-- 
Akihiko Odaki <akihiko.odaki@daynix.com>

Akihiko Odaki <akihiko.odaki@daynix.com> writes:

> Running qemu-system-aarch64 -M virt -nographic and terminating it will
> result in a LeakSanitizer error due to remaining queued CPU work so
> free it.
>
> Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>

FWIW this is likely the queued async task that
qemu_plugin_vcpu_init_hook sets up on the fake CPU -M virt creates at:

        /*
         * Instantiate a temporary CPU object to find out about what
         * we are about to deal with. Once this is done, get rid of
         * the object.
         */
        cpuobj = object_new(possible_cpus->cpus[0].type);
        armcpu = ARM_CPU(cpuobj);

        pa_bits = arm_pamax(armcpu);

        object_unref(cpuobj);

Anyway:

Tested-by: Alex Bennée <alex.bennee@linaro.org>


> ---
>  include/hw/core/cpu.h |  6 ++++++
>  cpu-common.c          | 11 +++++++++++
>  hw/core/cpu-common.c  |  1 +
>  3 files changed, 18 insertions(+)
>
> diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
> index a2c8536943f7..8e6466c1ddab 100644
> --- a/include/hw/core/cpu.h
> +++ b/include/hw/core/cpu.h
> @@ -1000,6 +1000,12 @@ void cpu_resume(CPUState *cpu);
>   */
>  void cpu_remove_sync(CPUState *cpu);
>  
> +/**
> + * free_queued_cpu_work() - free all items on CPU work queue
> + * @cpu: The CPU which work queue to free.
> + */
> +void free_queued_cpu_work(CPUState *cpu);
> +
>  /**
>   * process_queued_cpu_work() - process all items on CPU work queue
>   * @cpu: The CPU which work queue to process.
> diff --git a/cpu-common.c b/cpu-common.c
> index ce78273af597..7ae136f98ca7 100644
> --- a/cpu-common.c
> +++ b/cpu-common.c
> @@ -331,6 +331,17 @@ void async_safe_run_on_cpu(CPUState *cpu, run_on_cpu_func func,
>      queue_work_on_cpu(cpu, wi);
>  }
>  
> +void free_queued_cpu_work(CPUState *cpu)
> +{
> +    while (!QSIMPLEQ_EMPTY(&cpu->work_list)) {
> +        struct qemu_work_item *wi = QSIMPLEQ_FIRST(&cpu->work_list);
> +        QSIMPLEQ_REMOVE_HEAD(&cpu->work_list, node);
> +        if (wi->free) {
> +            g_free(wi);
> +        }
> +    }
> +}
> +
>  void process_queued_cpu_work(CPUState *cpu)
>  {
>      struct qemu_work_item *wi;
> diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
> index b19e1fdacf22..d2e3e4570ab7 100644
> --- a/hw/core/cpu-common.c
> +++ b/hw/core/cpu-common.c
> @@ -281,6 +281,7 @@ static void cpu_common_finalize(Object *obj)
>          g_free(cpu->plugin_state);
>      }
>  #endif
> +    free_queued_cpu_work(cpu);
>      g_array_free(cpu->gdb_regs, TRUE);
>      qemu_lockcnt_destroy(&cpu->in_ioctl_lock);
>      qemu_mutex_destroy(&cpu->work_mutex);
>
> ---
> base-commit: f2cb4026fccfe073f84a4b440e41d3ed0c3134f6
> change-id: 20240714-cpu-c4d28823b4c2
>
> Best regards,

-- 
Alex Bennée
Virtualisation Tech Lead @ Linaro

Queued, thanks.

Paolo