From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:44055) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1a3hbh-0004e2-G0 for qemu-devel@nongnu.org; Tue, 01 Dec 2015 04:52:22 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1a3hbe-0002Di-Ad for qemu-devel@nongnu.org; Tue, 01 Dec 2015 04:52:21 -0500 Received: from mx1.redhat.com ([209.132.183.28]:50628) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1a3hbe-0002DS-54 for qemu-devel@nongnu.org; Tue, 01 Dec 2015 04:52:18 -0500 References: <1448921464-21845-1-git-send-email-Don.Slutz@Gmail.com> From: Paolo Bonzini Message-ID: <565D6DCE.5010707@redhat.com> Date: Tue, 1 Dec 2015 10:52:14 +0100 MIME-Version: 1.0 In-Reply-To: <1448921464-21845-1-git-send-email-Don.Slutz@Gmail.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH] exec: Stop using memory after free List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Don Slutz , qemu-devel@nongnu.org Cc: Richard Henderson , Gonglei , Peter Crosthwaite On 30/11/2015 23:11, Don Slutz wrote: > memory_region_unref(mr) can free memory. > > For example I got: > > Program received signal SIGSEGV, Segmentation fault. > [Switching to Thread 0x7f43280d4700 (LWP 4462)] > 0x00007f43323283c0 in phys_section_destroy (mr=0x7f43259468b0) > at /home/don/xen/tools/qemu-xen-dir/exec.c:1023 > 1023 if (mr->subpage) { > (gdb) bt > at /home/don/xen/tools/qemu-xen-dir/exec.c:1023 > at /home/don/xen/tools/qemu-xen-dir/exec.c:1034 > at /home/don/xen/tools/qemu-xen-dir/exec.c:2205 > (gdb) p mr > $1 = (MemoryRegion *) 0x7f43259468b0 > > And this change prevents this. Great, thanks! I think this fixes also the problem that Gonglei was seeing a few months ago. I'll queue it for 2.5. BTW, since I have your attention, have you noticed my refresh/rewrite of your SAS1068 patches? A review would be welcome. Paolo > Signed-off-by: Don Slutz > --- > exec.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/exec.c b/exec.c > index de1cf19..0bf0a6e 100644 > --- a/exec.c > +++ b/exec.c > @@ -1064,9 +1064,11 @@ static uint16_t phys_section_add(PhysPageMap *map, > > static void phys_section_destroy(MemoryRegion *mr) > { > + bool have_sub_page = mr->subpage; > + > memory_region_unref(mr); > > - if (mr->subpage) { > + if (have_sub_page) { > subpage_t *subpage = container_of(mr, subpage_t, iomem); > object_unref(OBJECT(&subpage->iomem)); > g_free(subpage); >