Don't leak VLANClientState on PCI hot remove

destroy_nic() requires that NICInfo::private by a PCIDevice pointer,
but then goes on to require that the same pointer matches
VLANClientState::opaque.

That is no longer the case for virtio-net since qdev and wasn't
previously the case for rtl8139, ne2k_pci or eepro100.

Make the situation a lot more clear by maintaining a VLANClientState
pointer in NICInfo.

Signed-off-by: Mark McLoughlin <markmc@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

9 files changed, 25 insertions, 27 deletions

diff --git a/hw/device-hotplug.c b/hw/device-hotplug.c
index 3bdc048c68..e178083419 100644
--- a/hw/device-hotplug.c
+++ b/hw/device-hotplug.c
@@ -55,12 +55,7 @@ void destroy_nic(dev_match_fn *match_fn, void *arg)
         nic = &nd_table[i];
         if (nic->used) {
             if (nic->private && match_fn(nic->private, arg)) {
-                if (nic->vlan) {
-                    VLANClientState *vc;
-                    vc = qemu_find_vlan_client(nic->vlan, nic->private);
-                    if (vc)
-                        qemu_del_vlan_client(vc);
-                }
+                qemu_del_vlan_client(nic->vc);
                 net_client_uninit(nic);
             }
         }
diff --git a/hw/dp8393x.c b/hw/dp8393x.c
index 1a271954d5..e2f86b81d8 100644
--- a/hw/dp8393x.c
+++ b/hw/dp8393x.c
@@ -890,8 +890,9 @@ void dp83932_init(NICInfo *nd, target_phys_addr_t base, int it_shift,
     s->watchdog = qemu_new_timer(vm_clock, dp8393x_watchdog, s);
     s->regs[SONIC_SR] = 0x0004; /* only revision recognized by Linux */
 
-    s->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name, nic_can_receive,
-                                 nic_receive, NULL, nic_cleanup, s);
+    s->vc = nd->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
+                                          nic_can_receive, nic_receive, NULL,
+                                          nic_cleanup, s);
 
     qemu_format_nic_info_str(s->vc, nd->macaddr);
     qemu_register_reset(nic_reset, s);
diff --git a/hw/etraxfs_eth.c b/hw/etraxfs_eth.c
index 58f9f4e1f4..e1e5d8cae0 100644
--- a/hw/etraxfs_eth.c
+++ b/hw/etraxfs_eth.c
@@ -590,9 +590,9 @@ void *etraxfs_eth_init(NICInfo *nd, target_phys_addr_t base, int phyaddr)
 	eth->ethregs = cpu_register_io_memory(eth_read, eth_write, eth);
 	cpu_register_physical_memory (base, 0x5c, eth->ethregs);
 
-	eth->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
-				       eth_can_receive, eth_receive, NULL,
-				       eth_cleanup, eth);
+	eth->vc = nd->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
+                                                eth_can_receive, eth_receive,
+                                                NULL, eth_cleanup, eth);
 	eth->vc->opaque = eth;
 	eth->vc->link_status_changed = eth_set_link;
 
diff --git a/hw/mcf_fec.c b/hw/mcf_fec.c
index 1676bcb75c..27f27a6cd9 100644
--- a/hw/mcf_fec.c
+++ b/hw/mcf_fec.c
@@ -462,9 +462,9 @@ void mcf_fec_init(NICInfo *nd, target_phys_addr_t base, qemu_irq *irq)
                                            mcf_fec_writefn, s);
     cpu_register_physical_memory(base, 0x400, s->mmio_index);
 
-    s->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
-                                 mcf_fec_can_receive, mcf_fec_receive, NULL,
-                                 mcf_fec_cleanup, s);
+    s->vc = nd->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
+                                          mcf_fec_can_receive, mcf_fec_receive,
+                                          NULL, mcf_fec_cleanup, s);
     memcpy(s->macaddr, nd->macaddr, 6);
     qemu_format_nic_info_str(s->vc, s->macaddr);
 }
diff --git a/hw/mipsnet.c b/hw/mipsnet.c
index 803522949b..e98c57699b 100644
--- a/hw/mipsnet.c
+++ b/hw/mipsnet.c
@@ -263,9 +263,9 @@ void mipsnet_init (int base, qemu_irq irq, NICInfo *nd)
     s->io_base = base;
     s->irq = irq;
     if (nd && nd->vlan) {
-        s->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
-                                     mipsnet_can_receive, mipsnet_receive, NULL,
-                                     mipsnet_cleanup, s);
+        s->vc = nd->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
+                                              mipsnet_can_receive, mipsnet_receive,
+                                              NULL, mipsnet_cleanup, s);
     } else {
         s->vc = NULL;
     }
diff --git a/hw/ne2000.c b/hw/ne2000.c
index 66ff29d0fc..b9c018ab2e 100644
--- a/hw/ne2000.c
+++ b/hw/ne2000.c
@@ -759,9 +759,9 @@ void isa_ne2000_init(int base, qemu_irq irq, NICInfo *nd)
 
     ne2000_reset(s);
 
-    s->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
-                                 ne2000_can_receive, ne2000_receive, NULL,
-                                 isa_ne2000_cleanup, s);
+    s->vc = nd->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
+                                          ne2000_can_receive, ne2000_receive,
+                                          NULL, isa_ne2000_cleanup, s);
 
     qemu_format_nic_info_str(s->vc, s->macaddr);
 
diff --git a/hw/qdev.c b/hw/qdev.c
index 4c550094e2..83e98bf3ed 100644
--- a/hw/qdev.c
+++ b/hw/qdev.c
@@ -250,8 +250,9 @@ VLANClientState *qdev_get_vlan_client(DeviceState *dev,
 {
     NICInfo *nd = dev->nd;
     assert(nd);
-    return qemu_new_vlan_client(nd->vlan, nd->model, nd->name, can_receive,
-                                receive, receive_iov, cleanup, opaque);
+    nd->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name, can_receive,
+                                  receive, receive_iov, cleanup, opaque);
+    return nd->vc;
 }
 
 
diff --git a/hw/usb-net.c b/hw/usb-net.c
index 0e80ca6923..8214a68be2 100644
--- a/hw/usb-net.c
+++ b/hw/usb-net.c
@@ -1458,11 +1458,11 @@ USBDevice *usb_net_init(NICInfo *nd)
 
     pstrcpy(s->dev.devname, sizeof(s->dev.devname),
                     "QEMU USB Network Interface");
-    s->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
-                                 usbnet_can_receive,
-                                 usbnet_receive,
-                                 NULL,
-                                 usbnet_cleanup, s);
+    s->vc = nd->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
+                                          usbnet_can_receive,
+                                          usbnet_receive,
+                                          NULL,
+                                          usbnet_cleanup, s);
 
     qemu_format_nic_info_str(s->vc, s->mac);
 
diff --git a/net.h b/net.h
index 64d5e22f16..6026e10361 100644
--- a/net.h
+++ b/net.h
@@ -96,6 +96,7 @@ struct NICInfo {
     const char *name;
     const char *devaddr;
     VLANState *vlan;
+    VLANClientState *vc;
     void *private;
     int used;
     int bootable;