[Qemu-devel] [BUGFIX][PATCH v2 1/4] exec: Do not use MemoryRegion after free

[Don Slutz]

Here is gdb output that shows this happening:

  Breakpoint 3, object_finalize (data=0x7fdf32a14010) at qom/object.c:417
  417             obj->free(obj);
  (gdb) bt
  #0  object_finalize (data=0x7fdf32a14010) at qom/object.c:417
  #1  0x00000000007329d4 in object_unref (obj=0x7fdf32a14010) at 
qom/object.c:720
  #2  0x0000000000468a65 in memory_region_unref (mr=0x7fdf32a168b0) at 
xen/tools/qemu-xen-dir/memory.c:1359
  #3  0x000000000040eb52 in phys_section_destroy (mr=0x7fdf32a168b0) at 
xen/tools/qemu-xen-dir/exec.c:960
  #4  0x000000000040ec0a in phys_sections_free (map=0x3e51fc8) at 
xen/tools/qemu-xen-dir/exec.c:973
  #5  0x0000000000411cc9 in address_space_dispatch_free (d=0x3e51fb0) at 
xen/tools/qemu-xen-dir/exec.c:2133
  #6  0x0000000000840ae2 in call_rcu_thread (opaque=0x0) at util/rcu.c:256
  #7  0x00000032fdc07d14 in start_thread (arg=0x7fdf34866700) at 
pthread_create.c:309
  #8  0x00000032fd4f168d in clone () at 
../sysdeps/unix/sysv/linux/x86_64/clone.S:115
  (gdb) p obj
  $5 = (Object *) 0x7fdf32a14010
  (gdb) p *obj
  $6 = {class = 0x302f380, free = 0x40a1e0 <address@hidden>, properties = 
{tqh_first = 0x0, tqh_last = 0x7fdf32a14020},
  ref = 0, parent = 0x0}
  (gdb) up
  #1  0x00000000007329d4 in object_unref (obj=0x7fdf32a14010) at 
qom/object.c:720
  720             object_finalize(obj);
  (gdb) up
  #2  0x0000000000468a65 in memory_region_unref (mr=0x7fdf32a168b0) at 
xen/tools/qemu-xen-dir/memory.c:1359
  1359            object_unref(obj->parent);
  (gdb) up
  #3  0x000000000040eb52 in phys_section_destroy (mr=0x7fdf32a168b0) at 
xen/tools/qemu-xen-dir/exec.c:960
  960         memory_region_unref(mr);
  (gdb) l
  955         return map->sections_nb++;
  956     }
  957
  958     static void phys_section_destroy(MemoryRegion *mr)
  959     {
  960         memory_region_unref(mr);
  961
  962         if (mr->subpage) {
  963             subpage_t *subpage = container_of(mr, subpage_t, iomem);
  964             object_unref(OBJECT(&subpage->iomem));
  (gdb) p mr
  $7 = (MemoryRegion *) 0x7fdf32a168b0
  (gdb) p mr->subpage
  $9 = false
  (gdb) n
  419     }
  (gdb) n
  object_unref (obj=0x7fdf32a14010) at qom/object.c:722
  722     }
  (gdb) n
  memory_region_unref (mr=0x7fdf32a168b0) at 
xen/tools/qemu-xen-dir/memory.c:1363
  1363    }
  (gdb) n
  phys_section_destroy (mr=0x7fdf32a168b0) at xen/tools/qemu-xen-dir/exec.c:962
  962         if (mr->subpage) {
  (gdb) p mr
  $10 = (MemoryRegion *) 0x7fdf32a168b0
  (gdb) p *mr
  Cannot access memory at address 0x7fdf32a168b0

Signed-off-by: Don Slutz <address@hidden>
CC: Don Slutz <address@hidden>
---
 exec.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/exec.c b/exec.c
index 487583b..2f44a80 100644
--- a/exec.c
+++ b/exec.c
@@ -957,10 +957,14 @@ static uint16_t phys_section_add(PhysPageMap *map,
 
 static void phys_section_destroy(MemoryRegion *mr)
 {
-    memory_region_unref(mr);
+    subpage_t *subpage = NULL;
 
     if (mr->subpage) {
-        subpage_t *subpage = container_of(mr, subpage_t, iomem);
+        subpage = container_of(mr, subpage_t, iomem);
+    }
+    memory_region_unref(mr);
+
+    if (subpage) {
         object_unref(OBJECT(&subpage->iomem));
         g_free(subpage);
     }
-- 
1.8.4