From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:32852) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UrRBz-0006mn-C5 for qemu-devel@nongnu.org; Tue, 25 Jun 2013 07:13:48 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1UrRBx-0000BZ-PU for qemu-devel@nongnu.org; Tue, 25 Jun 2013 07:13:47 -0400 Received: from mail-ee0-x234.google.com ([2a00:1450:4013:c00::234]:64880) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UrRBx-0000BH-Iw for qemu-devel@nongnu.org; Tue, 25 Jun 2013 07:13:45 -0400 Received: by mail-ee0-f52.google.com with SMTP id c50so6659434eek.25 for ; Tue, 25 Jun 2013 04:13:44 -0700 (PDT) Sender: Paolo Bonzini From: Paolo Bonzini Date: Tue, 25 Jun 2013 13:13:18 +0200 Message-Id: <1372158807-19715-3-git-send-email-pbonzini@redhat.com> In-Reply-To: <1372158807-19715-1-git-send-email-pbonzini@redhat.com> References: <1372158807-19715-1-git-send-email-pbonzini@redhat.com> Subject: [Qemu-devel] [PATCH 02/11] memory: destroy phys_sections one by one List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org phys_sections_clear is invoked after the dispatch tree has been destroyed. This leaves a window where phys_sections_nb > 0 but the subpages are not valid anymore, which is a recipe for use-after-free bugs. Move the destruction of subpages in phys_sections_clear. Signed-off-by: Paolo Bonzini --- exec.c | 27 +++++++++++++-------------- 1 file changed, 13 insertions(+), 14 deletions(-) diff --git a/exec.c b/exec.c index 49474c9..33a572b 100644 --- a/exec.c +++ b/exec.c @@ -762,17 +762,6 @@ hwaddr memory_region_section_get_iotlb(CPUArchState *env, static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end, uint16_t section); static subpage_t *subpage_init(AddressSpace *as, hwaddr base); -static void destroy_page_desc(uint16_t section_index) -{ - MemoryRegionSection *section = &phys_sections[section_index]; - MemoryRegion *mr = section->mr; - - if (mr->subpage) { - subpage_t *subpage = container_of(mr, subpage_t, iomem); - memory_region_destroy(&subpage->iomem); - g_free(subpage); - } -} static void destroy_l2_mapping(PhysPageEntry *lp, unsigned level) { @@ -787,8 +776,6 @@ static void destroy_l2_mapping(PhysPageEntry *lp, unsigned level) for (i = 0; i < L2_SIZE; ++i) { if (!p[i].is_leaf) { destroy_l2_mapping(&p[i], level - 1); - } else { - destroy_page_desc(p[i].ptr); } } lp->is_leaf = 0; @@ -818,9 +805,21 @@ static uint16_t phys_section_add(MemoryRegionSection *section) return phys_sections_nb++; } +static void phys_section_destroy(MemoryRegion *mr) +{ + if (mr->subpage) { + subpage_t *subpage = container_of(mr, subpage_t, iomem); + memory_region_destroy(&subpage->iomem); + g_free(subpage); + } +} + static void phys_sections_clear(void) { - phys_sections_nb = 0; + while (phys_sections_nb > 0) { + MemoryRegionSection *section = &phys_sections[--phys_sections_nb]; + phys_section_destroy(section->mr); + } } static void register_subpage(AddressSpaceDispatch *d, MemoryRegionSection *section) -- 1.8.1.4