memory_region_find returns the memory region with an elevated reference count. Drop the reference count also if the memory region cannot be mapped writable.
Cc: [email protected] Signed-off-by: Paolo Bonzini <[email protected]> --- hw/i386/vapic.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hw/i386/vapic.c b/hw/i386/vapic.c index 9adce172621..5c3911cf9c8 100644 --- a/hw/i386/vapic.c +++ b/hw/i386/vapic.c @@ -614,11 +614,13 @@ static int vapic_map_rom_writable(VAPICROMState *s) /* read ROM size from RAM region */ if (rom_paddr + 2 >= memory_region_size(section.mr)) { + memory_region_unref(section.mr); return -1; } ram = memory_region_get_ram_ptr(section.mr); rom_size = ram[rom_paddr + 2] * ROM_BLOCK_SIZE; if (rom_size == 0 || rom_size > OPTION_ROM_END - rom_paddr) { + memory_region_unref(section.mr); return -1; } -- 2.55.0
