[PATCH 1/2] i386/vapic: unref MemoryRegion if vapic_map_rom_writable fails

[Paolo Bonzini <pbonzini@redhat.com>]

memory_region_find returns the memory region with an elevated
reference count.  Drop the reference count also if the memory
region cannot be mapped writable.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/vapic.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/i386/vapic.c b/hw/i386/vapic.c
index 8dd9188d96f..78dc2312bca 100644
--- a/hw/i386/vapic.c
+++ b/hw/i386/vapic.c
@@ -602,11 +602,13 @@ static int vapic_map_rom_writable(VAPICROMState *s)
 
     /* read ROM size from RAM region */
     if (rom_paddr + 2 >= memory_region_size(section.mr)) {
+        memory_region_unref(section.mr);
         return -1;
     }
     ram = memory_region_get_ram_ptr(section.mr);
     rom_size = ram[rom_paddr + 2] * ROM_BLOCK_SIZE;
     if (rom_size == 0) {
+        memory_region_unref(section.mr);
         return -1;
     }
     s->rom_size = rom_size;
-- 
2.55.0