[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-changelog] [qemu-xen stable-4.6] exec: Stop using memory after free
commit 9869880372c8e786502ce140d50158118e29a165 Author: Don Slutz <don.slutz@xxxxxxxxx> AuthorDate: Mon Nov 30 17:11:04 2015 -0500 Commit: Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx> CommitDate: Thu Feb 18 17:22:40 2016 +0000 exec: Stop using memory after free memory_region_unref(mr) can free memory. For example I got: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7f43280d4700 (LWP 4462)] 0x00007f43323283c0 in phys_section_destroy (mr=0x7f43259468b0) at /home/don/xen/tools/qemu-xen-dir/exec.c:1023 1023 if (mr->subpage) { (gdb) bt at /home/don/xen/tools/qemu-xen-dir/exec.c:1023 at /home/don/xen/tools/qemu-xen-dir/exec.c:1034 at /home/don/xen/tools/qemu-xen-dir/exec.c:2205 (gdb) p mr $1 = (MemoryRegion *) 0x7f43259468b0 And this change prevents this. upstream-commit-id: 55b4e80b047300e1512df02887b7448ba3786b62 Signed-off-by: Don Slutz <Don.Slutz@xxxxxxxxx> Message-Id: <1448921464-21845-1-git-send-email-Don.Slutz@xxxxxxxxx> Cc: qemu-stable@xxxxxxxxxx Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx> --- exec.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/exec.c b/exec.c index 46fe70e..28a6f12 100644 --- a/exec.c +++ b/exec.c @@ -943,9 +943,11 @@ static uint16_t phys_section_add(PhysPageMap *map, static void phys_section_destroy(MemoryRegion *mr) { + bool have_sub_page = mr->subpage; + memory_region_unref(mr); - if (mr->subpage) { + if (have_sub_page) { subpage_t *subpage = container_of(mr, subpage_t, iomem); object_unref(OBJECT(&subpage->iomem)); g_free(subpage); -- generated by git-patchbot for /home/xen/git/qemu-xen.git#stable-4.6 _______________________________________________ Xen-changelog mailing list Xen-changelog@xxxxxxxxxxxxx http://lists.xensource.com/xen-changelog
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |