From: Peter Maydell <[email protected]> address_space_destroy() doesn't actually immediately destroy the AS; it queues it to be destroyed via RCU. This means you can't g_free() the memory the AS struct is in until that has happened.
Clarify this in the documentation. Signed-off-by: Peter Maydell <[email protected]> Reviewed-by: David Hildenbrand <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Peter Xu <[email protected]> (cherry picked from commit 9e7bfda4909cc688dd0327e17985019f08a78d5d) (Mjt: this is just a comment fix, but it makes subsequent changes to apply c leanly) Signed-off-by: Michael Tokarev <[email protected]> diff --git a/include/system/memory.h b/include/system/memory.h index e2cd6ed126..30888daaeb 100644 --- a/include/system/memory.h +++ b/include/system/memory.h @@ -2715,9 +2715,14 @@ void address_space_init(AddressSpace *as, MemoryRegion *root, const char *name); /** * address_space_destroy: destroy an address space * - * Releases all resources associated with an address space. After an address space - * is destroyed, its root memory region (given by address_space_init()) may be destroyed - * as well. + * Releases all resources associated with an address space. After an + * address space is destroyed, the reference the AddressSpace had to + * its root memory region is dropped, which may result in the + * destruction of that memory region as well. + * + * Note that destruction of the AddressSpace is done via RCU; + * it is therefore not valid to free the memory the AddressSpace + * struct is in until after that RCU callback has completed. * * @as: address space to be destroyed */ -- 2.47.3
