Re: [Qemu-devel] [PATCH] memory: reduce heap Rss size around 3M

[Paolo Bonzini <pbonzini@redhat.com>]

On 08/03/2017 12:17, Philippe Mathieu-Daudé wrote:
> On 03/08/2017 12:11 PM, Yang Zhong wrote:
>> Since cpu-memory and memory have same address space,one malloced
>> memory is enough. This patch will skip memory malloc for memory
>> address space,which will reduce around 3M physical memory in heap.
>>
>> Signed-off-by: Yang Zhong <yang.zhong@intel.com>
> 
> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> 
>> ---
>>  memory.c | 6 ++++--
>>  1 file changed, 4 insertions(+), 2 deletions(-)
>>
>> diff --git a/memory.c b/memory.c
>> index 284894b..799ca4c 100644
>> --- a/memory.c
>> +++ b/memory.c
>> @@ -2422,8 +2422,10 @@ AddressSpace
>> *address_space_init_shareable(MemoryRegion *root, const char *name)
>>      AddressSpace *as;
>>
>>      QTAILQ_FOREACH(as, &address_spaces, address_spaces_link) {
>> -        if (root == as->root && as->malloced) {
>> -            as->ref_count++;
>> +        if (root == as->root) {
>> +            if (as->malloced) {
>> +                as->ref_count++;
>> +            }
>>              return as;
>>          }
>>      }
>>

This is wrong.  If as->malloced is false, the AddressSpace might be
embedded in another struct.  This other struct could be freed when
as->ref_count is still greater than 0, causing a use-after-free bug.

Paolo