[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[QEMU PATCH v4 07/13] softmmu/memory: enable automatic deallocation of m
From: |
Huang Rui |
Subject: |
[QEMU PATCH v4 07/13] softmmu/memory: enable automatic deallocation of memory regions |
Date: |
Thu, 31 Aug 2023 17:32:46 +0800 |
From: Xenia Ragiadakou <xenia.ragiadakou@amd.com>
When the memory region has a different life-cycle from that of her parent,
could be automatically released, once has been unparent and once all of her
references have gone away, via the object's free callback.
However, currently, references to the memory region are held by its owner
without first incrementing the memory region object's reference count.
As a result, the automatic deallocation of the object, not taking into
account those references, results in use-after-free memory corruption.
This patch increases the reference count of the memory region object on
each memory_region_ref() and decreases it on each memory_region_unref().
Signed-off-by: Xenia Ragiadakou <xenia.ragiadakou@amd.com>
Signed-off-by: Huang Rui <ray.huang@amd.com>
---
New patch
softmmu/memory.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
diff --git a/softmmu/memory.c b/softmmu/memory.c
index 7d9494ce70..0fdd5eebf9 100644
--- a/softmmu/memory.c
+++ b/softmmu/memory.c
@@ -1797,6 +1797,15 @@ Object *memory_region_owner(MemoryRegion *mr)
void memory_region_ref(MemoryRegion *mr)
{
+ if (!mr) {
+ return;
+ }
+
+ /* Obtain a reference to prevent the memory region object
+ * from being released under our feet.
+ */
+ object_ref(OBJECT(mr));
+
/* MMIO callbacks most likely will access data that belongs
* to the owner, hence the need to ref/unref the owner whenever
* the memory region is in use.
@@ -1807,16 +1816,22 @@ void memory_region_ref(MemoryRegion *mr)
* Memory regions without an owner are supposed to never go away;
* we do not ref/unref them because it slows down DMA sensibly.
*/
- if (mr && mr->owner) {
+ if (mr->owner) {
object_ref(mr->owner);
}
}
void memory_region_unref(MemoryRegion *mr)
{
- if (mr && mr->owner) {
+ if (!mr) {
+ return;
+ }
+
+ if (mr->owner) {
object_unref(mr->owner);
}
+
+ object_unref(OBJECT(mr));
}
uint64_t memory_region_size(MemoryRegion *mr)
--
2.34.1
- [QEMU PATCH v4 00/13] Support blob memory and venus on qemu, Huang Rui, 2023/08/31
- [QEMU PATCH v4 01/13] virtio: Add shared memory capability, Huang Rui, 2023/08/31
- [QEMU PATCH v4 02/13] virtio-gpu: CONTEXT_INIT feature, Huang Rui, 2023/08/31
- [QEMU PATCH v4 03/13] virtio-gpu: hostmem, Huang Rui, 2023/08/31
- [QEMU PATCH v4 04/13] virtio-gpu: blob prep, Huang Rui, 2023/08/31
- [QEMU PATCH v4 05/13] virtio-gpu: Support context init feature with virglrenderer, Huang Rui, 2023/08/31
- [QEMU PATCH v4 06/13] virtio-gpu: Configure context init for virglrenderer, Huang Rui, 2023/08/31
- [QEMU PATCH v4 07/13] softmmu/memory: enable automatic deallocation of memory regions,
Huang Rui <=
- [QEMU PATCH v4 08/13] virtio-gpu: Don't require udmabuf when blobs and virgl are enabled, Huang Rui, 2023/08/31
- [QEMU PATCH v4 09/13] virtio-gpu: Handle resource blob commands, Huang Rui, 2023/08/31
- [QEMU PATCH v4 10/13] virtio-gpu: Resource UUID, Huang Rui, 2023/08/31
- [QEMU PATCH v4 11/13] virtio-gpu: Support Venus capset, Huang Rui, 2023/08/31
- [QEMU PATCH v4 12/13] virtio-gpu: Initialize Venus, Huang Rui, 2023/08/31