From: Xenia Ragiadakou <xenia.ragiadakou@amd.com>
When the memory region has a different life-cycle from that of her
parent,
could be automatically released, once has been unparent and once all
of her
references have gone away, via the object's free callback.
However, currently, the address space subsystem keeps references to the
memory region without first incrementing its object's reference count.
As a result, the automatic deallocation of the object, not taking into
account those references, results in use-after-free memory corruption.
More specifically, reference to the memory region is kept in flatview
ranges. If the reference count of the memory region is not incremented,
flatview_destroy(), that is asynchronous, may be called after memory
region's destruction. If the reference count of the memory region is
incremented, memory region's destruction will take place after
flatview_destroy() has released its references.
This patch increases the reference count of an owned memory region object
on each memory_region_ref() and decreases it on each
memory_region_unref().