From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:54876) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1a3WfK-0005s4-1b for qemu-devel@nongnu.org; Mon, 30 Nov 2015 17:11:23 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1a3WfG-0004rY-15 for qemu-devel@nongnu.org; Mon, 30 Nov 2015 17:11:21 -0500 Received: from mail-yk0-x232.google.com ([2607:f8b0:4002:c07::232]:34186) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1a3WfF-0004rM-U3 for qemu-devel@nongnu.org; Mon, 30 Nov 2015 17:11:17 -0500 Received: by ykfs79 with SMTP id s79so203669822ykf.1 for ; Mon, 30 Nov 2015 14:11:17 -0800 (PST) From: Don Slutz Date: Mon, 30 Nov 2015 17:11:04 -0500 Message-Id: <1448921464-21845-1-git-send-email-Don.Slutz@Gmail.com> Subject: [Qemu-devel] [PATCH] exec: Stop using memory after free List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Paolo Bonzini , Richard Henderson , Don Slutz , Peter Crosthwaite memory_region_unref(mr) can free memory. For example I got: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7f43280d4700 (LWP 4462)] 0x00007f43323283c0 in phys_section_destroy (mr=0x7f43259468b0) at /home/don/xen/tools/qemu-xen-dir/exec.c:1023 1023 if (mr->subpage) { (gdb) bt at /home/don/xen/tools/qemu-xen-dir/exec.c:1023 at /home/don/xen/tools/qemu-xen-dir/exec.c:1034 at /home/don/xen/tools/qemu-xen-dir/exec.c:2205 (gdb) p mr $1 = (MemoryRegion *) 0x7f43259468b0 And this change prevents this. Signed-off-by: Don Slutz --- exec.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/exec.c b/exec.c index de1cf19..0bf0a6e 100644 --- a/exec.c +++ b/exec.c @@ -1064,9 +1064,11 @@ static uint16_t phys_section_add(PhysPageMap *map, static void phys_section_destroy(MemoryRegion *mr) { + bool have_sub_page = mr->subpage; + memory_region_unref(mr); - if (mr->subpage) { + if (have_sub_page) { subpage_t *subpage = container_of(mr, subpage_t, iomem); object_unref(OBJECT(&subpage->iomem)); g_free(subpage); -- 1.8.3.1