[Xen-changelog] [qemu-xen master] exec: Stop using memory after free

[patchbot@xxxxxxx]

commit 316a862e5534249a6e6d876b4e203342d3fb870e
Author:     Don Slutz <don.slutz@xxxxxxxxx>
AuthorDate: Mon Nov 30 17:11:04 2015 -0500
Commit:     Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>
CommitDate: Thu Feb 18 17:15:42 2016 +0000

    exec: Stop using memory after free
    
    memory_region_unref(mr) can free memory.
    
    For example I got:
    
    Program received signal SIGSEGV, Segmentation fault.
    [Switching to Thread 0x7f43280d4700 (LWP 4462)]
    0x00007f43323283c0 in phys_section_destroy (mr=0x7f43259468b0)
        at /home/don/xen/tools/qemu-xen-dir/exec.c:1023
    1023        if (mr->subpage) {
    (gdb) bt
        at /home/don/xen/tools/qemu-xen-dir/exec.c:1023
        at /home/don/xen/tools/qemu-xen-dir/exec.c:1034
        at /home/don/xen/tools/qemu-xen-dir/exec.c:2205
    (gdb) p mr
    $1 = (MemoryRegion *) 0x7f43259468b0
    
    And this change prevents this.
    
    Signed-off-by: Don Slutz <Don.Slutz@xxxxxxxxx>
    Message-Id: <1448921464-21845-1-git-send-email-Don.Slutz@xxxxxxxxx>
    Cc: qemu-stable@xxxxxxxxxx
    Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx>
---
 exec.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/exec.c b/exec.c
index 0a4a0c5..716f427 100644
--- a/exec.c
+++ b/exec.c
@@ -1018,9 +1018,11 @@ static uint16_t phys_section_add(PhysPageMap *map,
 
 static void phys_section_destroy(MemoryRegion *mr)
 {
+    bool have_sub_page = mr->subpage;
+
     memory_region_unref(mr);
 
-    if (mr->subpage) {
+    if (have_sub_page) {
         subpage_t *subpage = container_of(mr, subpage_t, iomem);
         object_unref(OBJECT(&subpage->iomem));
         g_free(subpage);
--
generated by git-patchbot for /home/xen/git/qemu-xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog