From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:43990) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1a498K-0003rI-AF for qemu-devel@nongnu.org; Wed, 02 Dec 2015 10:15:53 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1a498G-0007hS-DC for qemu-devel@nongnu.org; Wed, 02 Dec 2015 10:15:52 -0500 Received: from mx1.redhat.com ([209.132.183.28]:36635) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1a498G-0007hL-8e for qemu-devel@nongnu.org; Wed, 02 Dec 2015 10:15:48 -0500 From: Paolo Bonzini Date: Wed, 2 Dec 2015 16:15:37 +0100 Message-Id: <1449069340-10419-2-git-send-email-pbonzini@redhat.com> In-Reply-To: <1449069340-10419-1-git-send-email-pbonzini@redhat.com> References: <1449069340-10419-1-git-send-email-pbonzini@redhat.com> Subject: [Qemu-devel] [PULL 1/4] exec: Stop using memory after free List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Don Slutz From: Don Slutz memory_region_unref(mr) can free memory. For example I got: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7f43280d4700 (LWP 4462)] 0x00007f43323283c0 in phys_section_destroy (mr=0x7f43259468b0) at /home/don/xen/tools/qemu-xen-dir/exec.c:1023 1023 if (mr->subpage) { (gdb) bt at /home/don/xen/tools/qemu-xen-dir/exec.c:1023 at /home/don/xen/tools/qemu-xen-dir/exec.c:1034 at /home/don/xen/tools/qemu-xen-dir/exec.c:2205 (gdb) p mr $1 = (MemoryRegion *) 0x7f43259468b0 And this change prevents this. Signed-off-by: Don Slutz Message-Id: <1448921464-21845-1-git-send-email-Don.Slutz@Gmail.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini --- exec.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/exec.c b/exec.c index de1cf19..0bf0a6e 100644 --- a/exec.c +++ b/exec.c @@ -1064,9 +1064,11 @@ static uint16_t phys_section_add(PhysPageMap *map, static void phys_section_destroy(MemoryRegion *mr) { + bool have_sub_page = mr->subpage; + memory_region_unref(mr); - if (mr->subpage) { + if (have_sub_page) { subpage_t *subpage = container_of(mr, subpage_t, iomem); object_unref(OBJECT(&subpage->iomem)); g_free(subpage); -- 2.5.0