qom: fix device hot-unplug

Property removal modifies the list, so it is not safe to continue
iteration.  We know anyway that each object can have only one
parent (see object_property_add_child), so exit after finding
the requested object.

Reported-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

diff --git a/qom/object.c b/qom/object.c
index aa037d299f7fa596c6784965b6c698ef2c2e287e..39cbcb9b7519a9b5472c746645ca3ab7d07490d6 100644 (file)
--- a/qom/object.c
+++ b/qom/object.c
@@ -304,12 +304,9 @@ static void object_property_del_child(Object *obj, Object *child, Error **errp)
     ObjectProperty *prop;
 
     QTAILQ_FOREACH(prop, &obj->properties, node) {
-        if (!strstart(prop->type, "child<", NULL)) {
-            continue;
-        }
-
-        if (prop->opaque == child) {
+        if (strstart(prop->type, "child<", NULL) && prop->opaque == child) {
             object_property_del(obj, prop->name, errp);
+            break;
         }
     }
 }