From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:40060) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1a440l-0004v9-23 for qemu-devel@nongnu.org; Wed, 02 Dec 2015 04:47:43 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1a440g-000382-3C for qemu-devel@nongnu.org; Wed, 02 Dec 2015 04:47:42 -0500 Received: from mail-wm0-x22e.google.com ([2a00:1450:400c:c09::22e]:33276) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1a440f-00037e-SW for qemu-devel@nongnu.org; Wed, 02 Dec 2015 04:47:38 -0500 Received: by wmec201 with SMTP id c201so244413453wme.0 for ; Wed, 02 Dec 2015 01:47:37 -0800 (PST) Sender: Paolo Bonzini References: <1448921464-21845-1-git-send-email-Don.Slutz@Gmail.com> <565D6DCE.5010707@redhat.com> <33183CC9F5247A488A2544077AF19020B02AC190@SZXEMA503-MBS.china.huawei.com> From: Paolo Bonzini Message-ID: <565EBE31.7010304@redhat.com> Date: Wed, 2 Dec 2015 10:47:29 +0100 MIME-Version: 1.0 In-Reply-To: <33183CC9F5247A488A2544077AF19020B02AC190@SZXEMA503-MBS.china.huawei.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH] exec: Stop using memory after free List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Gonglei (Arei)" , Don Slutz , "qemu-devel@nongnu.org" Cc: Peter Crosthwaite , Richard Henderson On 02/12/2015 08:59, Gonglei (Arei) wrote: >>>> static void phys_section_destroy(MemoryRegion *mr) { >>>> + bool have_sub_page = mr->subpage; >>>> + >>>> memory_region_unref(mr); >>>> >>>> - if (mr->subpage) { >>>> + if (have_sub_page) { >>>> subpage_t *subpage = container_of(mr, subpage_t, iomem); > > Can we use the *mr* here again? Yes, in the subpage case the memory is allocated by exec.c. Accessing mr->subpage is only problematic if memory_region_unref destroys a device. > IMO we should invoke memory_region_unref(mr) after the if check. That's also possible. Paolo