[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 09/21] memory: keep the owner of the AddressSpace ali
From: |
Paolo Bonzini |
Subject: |
[Qemu-devel] [PULL 09/21] memory: keep the owner of the AddressSpace alive until do_address_space_destroy |
Date: |
Mon, 16 Feb 2015 19:17:50 +0100 |
This fixes a use-after-free if do_address_space_destroy is executed
too late.
Reviewed-by: Michael Roth <address@hidden>
Tested-by: Michael Roth <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
---
memory.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/memory.c b/memory.c
index 130152c..20f6d9e 100644
--- a/memory.c
+++ b/memory.c
@@ -1943,6 +1943,7 @@ void memory_listener_unregister(MemoryListener *listener)
void address_space_init(AddressSpace *as, MemoryRegion *root, const char *name)
{
+ memory_region_ref(root);
memory_region_transaction_begin();
as->root = root;
as->current_map = g_new(FlatView, 1);
@@ -1969,10 +1970,13 @@ static void do_address_space_destroy(AddressSpace *as)
flatview_unref(as->current_map);
g_free(as->name);
g_free(as->ioeventfds);
+ memory_region_unref(as->root);
}
void address_space_destroy(AddressSpace *as)
{
+ MemoryRegion *root = as->root;
+
/* Flush out anything from MemoryListeners listening in on this */
memory_region_transaction_begin();
as->root = NULL;
@@ -1984,6 +1988,7 @@ void address_space_destroy(AddressSpace *as)
* entries that the guest should never use. Wait for the old
* values to expire before freeing the data.
*/
+ as->root = root;
call_rcu(as, do_address_space_destroy, rcu);
}
--
2.3.0
- [Qemu-devel] [PULL 06/21] vhost-scsi: set the bootable value of channel/target/lun, (continued)
- [Qemu-devel] [PULL 06/21] vhost-scsi: set the bootable value of channel/target/lun, Paolo Bonzini, 2015/02/16
- [Qemu-devel] [PULL 07/21] rcu: do not let RCU callbacks pile up indefinitely, Paolo Bonzini, 2015/02/16
- [Qemu-devel] [PULL 05/21] vhost-scsi: add a property for booting, Paolo Bonzini, 2015/02/16
- [Qemu-devel] [PULL 01/21] kvm_stat: Add kvm_exit reasons for aarch64, Paolo Bonzini, 2015/02/16
- [Qemu-devel] [PULL 08/21] rcu: run RCU callbacks under the BQL, Paolo Bonzini, 2015/02/16
- [Qemu-devel] [PULL 10/21] pcie: remove mmconfig memory leak and wrap mmconfig update with transaction, Paolo Bonzini, 2015/02/16
- [Qemu-devel] [PULL 11/21] pci: split shpc_cleanup and shpc_free, Paolo Bonzini, 2015/02/16
- [Qemu-devel] [PULL 12/21] docs: clarify memory region lifecycle, Paolo Bonzini, 2015/02/16
- [Qemu-devel] [PULL 14/21] exec: make iotlb RCU-friendly, Paolo Bonzini, 2015/02/16
- [Qemu-devel] [PULL 15/21] exec: RCUify AddressSpaceDispatch, Paolo Bonzini, 2015/02/16
- [Qemu-devel] [PULL 09/21] memory: keep the owner of the AddressSpace alive until do_address_space_destroy,
Paolo Bonzini <=
- [Qemu-devel] [PULL 13/21] exec: introduce cpu_reload_memory_map, Paolo Bonzini, 2015/02/16
- [Qemu-devel] [PULL 16/21] rcu: introduce RCU-enabled QLIST, Paolo Bonzini, 2015/02/16
- [Qemu-devel] [PULL 19/21] cosmetic changes preparing for the following patches, Paolo Bonzini, 2015/02/16
- [Qemu-devel] [PULL 20/21] exec: convert ram_list to QLIST, Paolo Bonzini, 2015/02/16
- [Qemu-devel] [PULL 21/21] Convert ram_list to RCU, Paolo Bonzini, 2015/02/16
- [Qemu-devel] [PULL 17/21] rcu: add g_free_rcu, Paolo Bonzini, 2015/02/16
- [Qemu-devel] [PULL 18/21] exec: protect mru_block with RCU, Paolo Bonzini, 2015/02/16
- Re: [Qemu-devel] [PULL 00/21] SCSI, RCU, KVM changes for 2015-02-16, Peter Maydell, 2015/02/25