aboutsummaryrefslogtreecommitdiff
path: root/exec.c
diff options
context:
space:
mode:
authorPaolo Bonzini <pbonzini@redhat.com>2013-06-25 09:30:48 +0200
committerPaolo Bonzini <pbonzini@redhat.com>2013-07-04 17:42:44 +0200
commit058bc4b57f9d6b39d9a6748b4049e1be3fde3dac (patch)
tree54fbb9dd492ac08fccd66b274dbf5545071cfc9a /exec.c
parent2c9b15cab12c21e32dffb67c5e18f3dc407ca224 (diff)
downloadqemu-058bc4b57f9d6b39d9a6748b4049e1be3fde3dac.zip
qemu-058bc4b57f9d6b39d9a6748b4049e1be3fde3dac.tar.gz
qemu-058bc4b57f9d6b39d9a6748b4049e1be3fde3dac.tar.bz2
memory: destroy phys_sections one by one
phys_sections_clear is invoked after the dispatch tree has been destroyed. This leaves a window where phys_sections_nb > 0 but the subpages are not valid anymore, which is a recipe for use-after-free bugs. Move the destruction of subpages in phys_sections_clear. We will still destroy the subpages when an address space is cleaned up, because address_space_destroy will clear as->root and commit the change before it calls address_space_destroy_dispatch. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'exec.c')
-rw-r--r--exec.c27
1 files changed, 13 insertions, 14 deletions
diff --git a/exec.c b/exec.c
index 5094746..78be4f5 100644
--- a/exec.c
+++ b/exec.c
@@ -754,17 +754,6 @@ hwaddr memory_region_section_get_iotlb(CPUArchState *env,
static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end,
uint16_t section);
static subpage_t *subpage_init(AddressSpace *as, hwaddr base);
-static void destroy_page_desc(uint16_t section_index)
-{
- MemoryRegionSection *section = &phys_sections[section_index];
- MemoryRegion *mr = section->mr;
-
- if (mr->subpage) {
- subpage_t *subpage = container_of(mr, subpage_t, iomem);
- memory_region_destroy(&subpage->iomem);
- g_free(subpage);
- }
-}
static void destroy_l2_mapping(PhysPageEntry *lp, unsigned level)
{
@@ -779,8 +768,6 @@ static void destroy_l2_mapping(PhysPageEntry *lp, unsigned level)
for (i = 0; i < L2_SIZE; ++i) {
if (!p[i].is_leaf) {
destroy_l2_mapping(&p[i], level - 1);
- } else {
- destroy_page_desc(p[i].ptr);
}
}
lp->is_leaf = 0;
@@ -810,9 +797,21 @@ static uint16_t phys_section_add(MemoryRegionSection *section)
return phys_sections_nb++;
}
+static void phys_section_destroy(MemoryRegion *mr)
+{
+ if (mr->subpage) {
+ subpage_t *subpage = container_of(mr, subpage_t, iomem);
+ memory_region_destroy(&subpage->iomem);
+ g_free(subpage);
+ }
+}
+
static void phys_sections_clear(void)
{
- phys_sections_nb = 0;
+ while (phys_sections_nb > 0) {
+ MemoryRegionSection *section = &phys_sections[--phys_sections_nb];
+ phys_section_destroy(section->mr);
+ }
}
static void register_subpage(AddressSpaceDispatch *d, MemoryRegionSection *section)