proxmox-mirrors/qemu
1
0
Fork 0
mirror of https://git.proxmox.com/git/qemu synced 2025-07-09 10:03:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

memory: destroy phys_sections one by one

Browse Source 
phys_sections_clear is invoked after the dispatch tree has been
destroyed.  This leaves a window where phys_sections_nb > 0 but the
subpages are not valid anymore, which is a recipe for use-after-free
bugs.

Move the destruction of subpages in phys_sections_clear.  We will
still destroy the subpages when an address space is cleaned up,
because address_space_destroy will clear as->root and commit the
change before it calls address_space_destroy_dispatch.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
Paolo Bonzini 2013-06-25 09:30:48 +02:00
parent 2c9b15cab1
commit 058bc4b57f
1 changed files with 13 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
exec.c
View File

@ -754,17 +754,6 @@ hwaddr memory_region_section_get_iotlb(CPUArchState *env,
static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end, static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end,
uint16_t section); uint16_t section);
static subpage_t *subpage_init(AddressSpace *as, hwaddr base); static subpage_t *subpage_init(AddressSpace *as, hwaddr base);
static void destroy_page_desc(uint16_t section_index)
{
MemoryRegionSection *section = &phys_sections[section_index];
MemoryRegion *mr = section->mr;
if (mr->subpage) {
subpage_t *subpage = container_of(mr, subpage_t, iomem);
memory_region_destroy(&subpage->iomem);
g_free(subpage);
}
}
static void destroy_l2_mapping(PhysPageEntry *lp, unsigned level) static void destroy_l2_mapping(PhysPageEntry *lp, unsigned level)
{ {
@ -779,8 +768,6 @@ static void destroy_l2_mapping(PhysPageEntry *lp, unsigned level)
for (i = 0; i < L2_SIZE; ++i) { for (i = 0; i < L2_SIZE; ++i) {
if (!p[i].is_leaf) { if (!p[i].is_leaf) {
destroy_l2_mapping(&p[i], level - 1); destroy_l2_mapping(&p[i], level - 1);
} else {
destroy_page_desc(p[i].ptr);
} }
} }
lp->is_leaf = 0; lp->is_leaf = 0;
@ -810,9 +797,21 @@ static uint16_t phys_section_add(MemoryRegionSection *section)
return phys_sections_nb++; return phys_sections_nb++;
} }
static void phys_section_destroy(MemoryRegion *mr)
{
if (mr->subpage) {
subpage_t *subpage = container_of(mr, subpage_t, iomem);
memory_region_destroy(&subpage->iomem);
g_free(subpage);
}
}
static void phys_sections_clear(void) static void phys_sections_clear(void)
{ {
phys_sections_nb = 0; while (phys_sections_nb > 0) {
MemoryRegionSection *section = &phys_sections[--phys_sections_nb];
phys_section_destroy(section->mr);
}
} }
static void register_subpage(AddressSpaceDispatch *d, MemoryRegionSection *section) static void register_subpage(AddressSpaceDispatch *d, MemoryRegionSection *section)