mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

memory: keep the owner of the AddressSpace alive until do_address_space_destroy

Browse Source 
This fixes a use-after-free if do_address_space_destroy is executed
too late.

Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Tested-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
Paolo Bonzini 2015-02-11 15:21:04 +01:00
parent a464982499
commit ac95190ea9
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
memory.c
View File

@ -1943,6 +1943,7 @@ void memory_listener_unregister(MemoryListener *listener)
void address_space_init(AddressSpace *as, MemoryRegion *root, const char *name) void address_space_init(AddressSpace *as, MemoryRegion *root, const char *name)
{ {
memory_region_ref(root);
memory_region_transaction_begin(); memory_region_transaction_begin();
as->root = root; as->root = root;
as->current_map = g_new(FlatView, 1); as->current_map = g_new(FlatView, 1);
@ -1969,10 +1970,13 @@ static void do_address_space_destroy(AddressSpace *as)
flatview_unref(as->current_map); flatview_unref(as->current_map);
g_free(as->name); g_free(as->name);
g_free(as->ioeventfds); g_free(as->ioeventfds);
memory_region_unref(as->root);
} }
void address_space_destroy(AddressSpace *as) void address_space_destroy(AddressSpace *as)
{ {
MemoryRegion *root = as->root;
/* Flush out anything from MemoryListeners listening in on this */ /* Flush out anything from MemoryListeners listening in on this */
memory_region_transaction_begin(); memory_region_transaction_begin();
as->root = NULL; as->root = NULL;
@ -1984,6 +1988,7 @@ void address_space_destroy(AddressSpace *as)
* entries that the guest should never use. Wait for the old * entries that the guest should never use. Wait for the old
* values to expire before freeing the data. * values to expire before freeing the data.
*/ */
as->root = root;
call_rcu(as, do_address_space_destroy, rcu); call_rcu(as, do_address_space_destroy, rcu);
} }