aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPaolo Bonzini <pbonzini@redhat.com>2015-07-27 16:29:56 +0200
committerPaolo Bonzini <pbonzini@redhat.com>2015-07-27 23:05:49 +0200
commit52c91dac6bd891656f297dab76da51fc8bc61309 (patch)
tree5ae829b25f1ed315042ede4f3642104d101d929d
parent55875fc4ca45a35e36134663ade946d86fe7bfcd (diff)
downloadqemu-52c91dac6bd891656f297dab76da51fc8bc61309.zip
qemu-52c91dac6bd891656f297dab76da51fc8bc61309.tar.gz
qemu-52c91dac6bd891656f297dab76da51fc8bc61309.tar.bz2
memory: do not add a reference to the owner of aliased regions
Very often the owner of the aliased region is the same as the owner of the alias region itself. When this happens, the reference count can never go back to 0 and the owner is leaked. This is for example breaking hot-unplug of virtio-pci devices (the device cannot be plugged back again with the same id). Another common use for alias is to transform the system I/O address space into an MMIO regions; in this case the aliased region never dies, so there is no problem. Otherwise the owner is always the same for aliasing and aliased region. I checked all calls to memory_region_init_alias introduced after commit dfde4e6 (memory: add ref/unref calls, 2013-05-06) and they do not need the reference in order to keep the owner of the aliased region alive. Reported-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-rw-r--r--memory.c7
1 files changed, 0 insertions, 7 deletions
diff --git a/memory.c b/memory.c
index 5e5f325..4eb138a 100644
--- a/memory.c
+++ b/memory.c
@@ -859,11 +859,6 @@ static void memory_region_destructor_ram(MemoryRegion *mr)
qemu_ram_free(mr->ram_addr);
}
-static void memory_region_destructor_alias(MemoryRegion *mr)
-{
- memory_region_unref(mr->alias);
-}
-
static void memory_region_destructor_ram_from_ptr(MemoryRegion *mr)
{
qemu_ram_free_from_ptr(mr->ram_addr);
@@ -1272,8 +1267,6 @@ void memory_region_init_alias(MemoryRegion *mr,
uint64_t size)
{
memory_region_init(mr, owner, name, size);
- memory_region_ref(orig);
- mr->destructor = memory_region_destructor_alias;
mr->alias = orig;
mr->alias_offset = offset;
}