Re: [PATCH v6 06/11] softmmu/memory: enable automatic deallocation of memory regions

[Akihiko Odaki <akihiko.odaki@xxxxxxxxxx>]

On 2023/12/21 16:35, Xenia Ragiadakou wrote:
> On 21/12/23 07:45, Akihiko Odaki wrote:
> > On 2023/12/19 16:53, Huang Rui wrote:
> > > From: Xenia Ragiadakou <xenia.ragiadakou@xxxxxxx>
> > >
> > > When the memory region has a different life-cycle from that of her 
> > > parent,
> > > could be automatically released, once has been unparent and once all 
> > > of her
> > > references have gone away, via the object's free callback.
> > >
> > > However, currently, the address space subsystem keeps references to the
> > > memory region without first incrementing its object's reference count.
> > > As a result, the automatic deallocation of the object, not taking into
> > > account those references, results in use-after-free memory corruption.
> > >
> > > More specifically, reference to the memory region is kept in flatview
> > > ranges. If the reference count of the memory region is not incremented,
> > > flatview_destroy(), that is asynchronous, may be called after memory
> > > region's destruction. If the reference count of the memory region is
> > > incremented, memory region's destruction will take place after
> > > flatview_destroy() has released its references.
> > >
> > > This patch increases the reference count of an owned memory region 
> > > object
> > > on each memory_region_ref() and decreases it on each 
> > > memory_region_unref().
> > Why not pass the memory region itself as the owner parameter of 
> > memory_region_init_ram_ptr()?
> Hmm, in that case, how will it be guaranteed that the VirtIOGPU won't 
> disappear while the memory region is still in use?
You can object_ref() when you do memory_region_init_ram_ptr() and 
object_unref() when the memory region is being destroyed.