[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH v2 02/11] memory: destroy phys_sections one by one
From: |
Paolo Bonzini |
Subject: |
[Qemu-devel] [PATCH v2 02/11] memory: destroy phys_sections one by one |
Date: |
Fri, 28 Jun 2013 18:58:13 +0200 |
phys_sections_clear is invoked after the dispatch tree has been
destroyed. This leaves a window where phys_sections_nb > 0 but the
subpages are not valid anymore, which is a recipe for use-after-free
bugs.
Move the destruction of subpages in phys_sections_clear.
Signed-off-by: Paolo Bonzini <address@hidden>
---
exec.c | 27 +++++++++++++--------------
1 file changed, 13 insertions(+), 14 deletions(-)
diff --git a/exec.c b/exec.c
index 1118587..e7eadf5 100644
--- a/exec.c
+++ b/exec.c
@@ -762,17 +762,6 @@ hwaddr memory_region_section_get_iotlb(CPUArchState *env,
static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end,
uint16_t section);
static subpage_t *subpage_init(AddressSpace *as, hwaddr base);
-static void destroy_page_desc(uint16_t section_index)
-{
- MemoryRegionSection *section = &phys_sections[section_index];
- MemoryRegion *mr = section->mr;
-
- if (mr->subpage) {
- subpage_t *subpage = container_of(mr, subpage_t, iomem);
- memory_region_destroy(&subpage->iomem);
- g_free(subpage);
- }
-}
static void destroy_l2_mapping(PhysPageEntry *lp, unsigned level)
{
@@ -787,8 +776,6 @@ static void destroy_l2_mapping(PhysPageEntry *lp, unsigned
level)
for (i = 0; i < L2_SIZE; ++i) {
if (!p[i].is_leaf) {
destroy_l2_mapping(&p[i], level - 1);
- } else {
- destroy_page_desc(p[i].ptr);
}
}
lp->is_leaf = 0;
@@ -818,9 +805,21 @@ static uint16_t phys_section_add(MemoryRegionSection
*section)
return phys_sections_nb++;
}
+static void phys_section_destroy(MemoryRegion *mr)
+{
+ if (mr->subpage) {
+ subpage_t *subpage = container_of(mr, subpage_t, iomem);
+ memory_region_destroy(&subpage->iomem);
+ g_free(subpage);
+ }
+}
+
static void phys_sections_clear(void)
{
- phys_sections_nb = 0;
+ while (phys_sections_nb > 0) {
+ MemoryRegionSection *section = &phys_sections[--phys_sections_nb];
+ phys_section_destroy(section->mr);
+ }
}
static void register_subpage(AddressSpaceDispatch *d, MemoryRegionSection
*section)
--
1.8.1.4
- [Qemu-devel] [PATCH v2 00/11] Memory patches, part 4: region ownership, Paolo Bonzini, 2013/06/28
- [Qemu-devel] [PATCH v2 02/11] memory: destroy phys_sections one by one,
Paolo Bonzini <=
- [Qemu-devel] [PATCH v2 03/11] exec: simplify destruction of the phys map, Paolo Bonzini, 2013/06/28
- [Qemu-devel] [PATCH v2 04/11] memory: add getter for owner, Paolo Bonzini, 2013/06/28
- [Qemu-devel] [PATCH v2 07/11] exec: check MRU in qemu_ram_addr_from_host, Paolo Bonzini, 2013/06/28
- [Qemu-devel] [PATCH v2 05/11] memory: add ref/unref, Paolo Bonzini, 2013/06/28
- [Qemu-devel] [PATCH v2 06/11] memory: add ref/unref calls, Paolo Bonzini, 2013/06/28
- [Qemu-devel] [PATCH v2 08/11] exec: move qemu_ram_addr_from_host_nofail to cputlb.c, Paolo Bonzini, 2013/06/28
- [Qemu-devel] [PATCH v2 09/11] memory: return MemoryRegion from qemu_ram_addr_from_host, Paolo Bonzini, 2013/06/28
- [Qemu-devel] [PATCH v2 10/11] exec: reorganize address_space_map, Paolo Bonzini, 2013/06/28
- [Qemu-devel] [PATCH v2 11/11] memory: ref/unref memory across address_space_map/unmap, Paolo Bonzini, 2013/06/28
- [Qemu-devel] [PATCH v2 01/11] memory: add owner argument to initialization functions, Paolo Bonzini, 2013/06/28