Revision 058bc4b5
| ID | 058bc4b57f9d6b39d9a6748b4049e1be3fde3dac |
memory: destroy phys_sections one by one
phys_sections_clear is invoked after the dispatch tree has been
destroyed. This leaves a window where phys_sections_nb > 0 but the
subpages are not valid anymore, which is a recipe for use-after-free
bugs.
Move the destruction of subpages in phys_sections_clear. We will
still destroy the subpages when an address space is cleaned up,
because address_space_destroy will clear as->root and commit the
change before it calls address_space_destroy_dispatch.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Files
- added
- modified
- copied
- renamed
- deleted