diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2013-06-25 09:30:48 +0200 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2013-07-04 17:42:44 +0200 |
| commit | 058bc4b57f9d6b39d9a6748b4049e1be3fde3dac (patch) | |
| tree | 54fbb9dd492ac08fccd66b274dbf5545071cfc9a /memory.c | |
| parent | 2c9b15cab12c21e32dffb67c5e18f3dc407ca224 (diff) | |
| download | hqemu-058bc4b57f9d6b39d9a6748b4049e1be3fde3dac.zip hqemu-058bc4b57f9d6b39d9a6748b4049e1be3fde3dac.tar.gz | |
memory: destroy phys_sections one by one
phys_sections_clear is invoked after the dispatch tree has been
destroyed. This leaves a window where phys_sections_nb > 0 but the
subpages are not valid anymore, which is a recipe for use-after-free
bugs.
Move the destruction of subpages in phys_sections_clear. We will
still destroy the subpages when an address space is cleaned up,
because address_space_destroy will clear as->root and commit the
change before it calls address_space_destroy_dispatch.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'memory.c')
0 files changed, 0 insertions, 0 deletions
