Once address_space_translate will only be protected by RCU, the returned MemoryRegion can disappear as soon as the RCU read-side critical section ends. Avoid this by adding a reference to the region, and dropping it in the caller of address_space_translate.
Signed-off-by: Paolo Bonzini <pbonz...@redhat.com> --- exec.c | 16 ++++++++++++++-- include/exec/memory.h | 3 ++- 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/exec.c b/exec.c index ba50e8d..bf287cb 100644 --- a/exec.c +++ b/exec.c @@ -292,6 +292,7 @@ MemoryRegion *address_space_translate(AddressSpace *as, hwaddr addr, *plen = len; *xlat = addr; + memory_region_ref(mr); return mr; } @@ -1994,6 +1995,7 @@ bool address_space_rw(AddressSpace *as, hwaddr addr, uint8_t *buf, memcpy(buf, ptr, l); } } + memory_region_unref(mr); len -= l; buf += l; addr += l; @@ -2159,8 +2161,10 @@ void *address_space_map(AddressSpace *as, raddr = memory_region_get_ram_addr(mr) + xlat; } else { if (memory_region_get_ram_addr(mr) + xlat != raddr + todo) { + memory_region_unref(mr); break; } + memory_region_unref(mr); } len -= l; @@ -2260,6 +2264,7 @@ static inline uint32_t ldl_phys_internal(hwaddr addr, break; } } + memory_region_unref(mr); return val; } @@ -2319,6 +2324,7 @@ static inline uint64_t ldq_phys_internal(hwaddr addr, break; } } + memory_region_unref(mr); return val; } @@ -2386,6 +2392,7 @@ static inline uint32_t lduw_phys_internal(hwaddr addr, break; } } + memory_region_unref(mr); return val; } @@ -2433,6 +2440,7 @@ void stl_phys_notdirty(hwaddr addr, uint32_t val) } } } + memory_region_unref(mr); } /* warning: addr must be aligned */ @@ -2474,6 +2482,7 @@ static inline void stl_phys_internal(hwaddr addr, uint32_t val, } invalidate_and_set_dirty(addr1, 4); } + memory_region_unref(mr); } void stl_phys(hwaddr addr, uint32_t val) @@ -2537,6 +2546,7 @@ static inline void stw_phys_internal(hwaddr addr, uint32_t val, } invalidate_and_set_dirty(addr1, 2); } + memory_region_unref(mr); } void stw_phys(hwaddr addr, uint32_t val) @@ -2626,11 +2636,13 @@ bool cpu_physical_memory_is_io(hwaddr phys_addr) { MemoryRegion*mr; hwaddr l = 1; + bool res; mr = address_space_translate(&address_space_memory, phys_addr, &phys_addr, &l, false); - return !(memory_region_is_ram(mr) || - memory_region_is_romd(mr)); + res = !(memory_region_is_ram(mr) || memory_region_is_romd(mr)); + memory_region_unref(mr); + return res; } #endif diff --git a/include/exec/memory.h b/include/exec/memory.h index bfcdf65..a2546b7 100644 --- a/include/exec/memory.h +++ b/include/exec/memory.h @@ -1015,7 +1015,8 @@ bool address_space_write(AddressSpace *as, hwaddr addr, bool address_space_read(AddressSpace *as, hwaddr addr, uint8_t *buf, int len); /* address_space_translate: translate an address range into an address space - * into a MemoryRegion and an address range into that section + * into a MemoryRegion and an address range into that section. Add a reference + * to that region. * * @as: #AddressSpace to be accessed * @addr: address within that address space -- 1.8.1.4