From 07c114bbf389c09c99fd451b0b0fddf88962f512 Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Wed, 15 Nov 2017 15:11:03 +0100 Subject: exec: Do not resolve subpage in mru_section This fixes a crash caused by picking the wrong memory region in address_space_lookup_region seen with client code accessing a device model that uses alias memory regions. The expensive part of address_space_lookup_region anyway is phys_page_find; performance-wise it is okay to repeat the subsequent subpage lookup. Signed-off-by: BALATON Zoltan Message-Id: <20171114225941.072707456B5@zero.eik.bme.hu> Signed-off-by: Paolo Bonzini --- exec.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) (limited to 'exec.c') diff --git a/exec.c b/exec.c index 97a24a875e..3bb9fcf257 100644 --- a/exec.c +++ b/exec.c @@ -410,22 +410,16 @@ static MemoryRegionSection *address_space_lookup_region(AddressSpaceDispatch *d, { MemoryRegionSection *section = atomic_read(&d->mru_section); subpage_t *subpage; - bool update; - if (section && section != &d->map.sections[PHYS_SECTION_UNASSIGNED] && - section_covers_addr(section, addr)) { - update = false; - } else { + if (!section || section == &d->map.sections[PHYS_SECTION_UNASSIGNED] || + !section_covers_addr(section, addr)) { section = phys_page_find(d, addr); - update = true; + atomic_set(&d->mru_section, section); } if (resolve_subpage && section->mr->subpage) { subpage = container_of(section->mr, subpage_t, iomem); section = &d->map.sections[subpage->sub_section[SUBPAGE_IDX(addr)]]; } - if (update) { - atomic_set(&d->mru_section, section); - } return section; } -- cgit v1.2.1