aboutsummaryrefslogtreecommitdiff
path: root/memory.c
diff options
context:
space:
mode:
authorPaolo Bonzini <pbonzini@redhat.com>2015-02-11 15:21:04 +0100
committerPaolo Bonzini <pbonzini@redhat.com>2015-02-11 21:48:44 +0100
commitac95190ea92f7625bb0065c2864321607b95c26b (patch)
tree80e1901692ef514cb738a2ec048feaf914b7674d /memory.c
parenta464982499b2f637f6699e3d03e0a9d2e0b5288b (diff)
downloadqemu-arm-ac95190ea92f7625bb0065c2864321607b95c26b.tar.gz
memory: keep the owner of the AddressSpace alive until do_address_space_destroy
This fixes a use-after-free if do_address_space_destroy is executed too late. Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com> Tested-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'memory.c')
-rw-r--r--memory.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/memory.c b/memory.c
index 130152cf1d..20f6d9eeac 100644
--- a/memory.c
+++ b/memory.c
@@ -1943,6 +1943,7 @@ void memory_listener_unregister(MemoryListener *listener)
void address_space_init(AddressSpace *as, MemoryRegion *root, const char *name)
{
+ memory_region_ref(root);
memory_region_transaction_begin();
as->root = root;
as->current_map = g_new(FlatView, 1);
@@ -1969,10 +1970,13 @@ static void do_address_space_destroy(AddressSpace *as)
flatview_unref(as->current_map);
g_free(as->name);
g_free(as->ioeventfds);
+ memory_region_unref(as->root);
}
void address_space_destroy(AddressSpace *as)
{
+ MemoryRegion *root = as->root;
+
/* Flush out anything from MemoryListeners listening in on this */
memory_region_transaction_begin();
as->root = NULL;
@@ -1984,6 +1988,7 @@ void address_space_destroy(AddressSpace *as)
* entries that the guest should never use. Wait for the old
* values to expire before freeing the data.
*/
+ as->root = root;
call_rcu(as, do_address_space_destroy, rcu);
}