mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

memory: do not add a reference to the owner of aliased regions

Browse Source 
Very often the owner of the aliased region is the same as the owner of the alias
region itself.  When this happens, the reference count can never go back to 0 and
the owner is leaked.  This is for example breaking hot-unplug of virtio-pci
devices (the device cannot be plugged back again with the same id).

Another common use for alias is to transform the system I/O address space
into an MMIO regions; in this case the aliased region never dies, so there
is no problem.  Otherwise the owner is always the same for aliasing
and aliased region.

I checked all calls to memory_region_init_alias introduced after commit
dfde4e6 (memory: add ref/unref calls, 2013-05-06) and they do not need the
reference in order to keep the owner of the aliased region alive.

Reported-by: Michael S. Tsirkin <mst@redhat.com>
Tested-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
Paolo Bonzini 2015-07-27 16:29:56 +02:00
parent 55875fc4ca
commit 52c91dac6b
1 changed files with 0 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
memory.c
View File

@ -859,11 +859,6 @@ static void memory_region_destructor_ram(MemoryRegion *mr)
qemu_ram_free(mr->ram_addr); qemu_ram_free(mr->ram_addr);
} }
static void memory_region_destructor_alias(MemoryRegion *mr)
{
memory_region_unref(mr->alias);
}
static void memory_region_destructor_ram_from_ptr(MemoryRegion *mr) static void memory_region_destructor_ram_from_ptr(MemoryRegion *mr)
{ {
qemu_ram_free_from_ptr(mr->ram_addr); qemu_ram_free_from_ptr(mr->ram_addr);
@ -1272,8 +1267,6 @@ void memory_region_init_alias(MemoryRegion *mr,
uint64_t size) uint64_t size)
{ {
memory_region_init(mr, owner, name, size); memory_region_init(mr, owner, name, size);
memory_region_ref(orig);
mr->destructor = memory_region_destructor_alias;
mr->alias = orig; mr->alias = orig;
mr->alias_offset = offset; mr->alias_offset = offset;
} }