Re: [PATCH] system/physmem: fix use-after-free with dispatch

[Richard Henderson <richard.henderson@linaro.org>]

On 7/24/25 09:11, Pierrick Bouvier wrote:
> This patch takes a simple approach: remove the cached value creating the
> issue, and make sure we always get the current mapping for address
> space, using address_space_to_dispatch(cpu->cpu_ases[asidx].as).
> It's equivalent to qatomic_rcu_read(&as->current_map)->dispatch;
> This is not really costly, we just need two dereferences,
> including one atomic (rcu) read, which is negligible considering we are
> already on mmu slow path anyway.

We're not just on the slow path, we're on the tlb fill path, which is even rarer.  Once 
upon a time, memory_dispatch was used along the mmio path, but even then I think it must 
have been premature optimization.

This looks like an excellent solution.
Thanks for all the detective work.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>


r~