From: Paolo Bonzini <[email protected]> memory_region_find returns the memory region with an elevated reference count. Drop the reference count also if the memory region cannot be mapped writable.
Cc: [email protected] Signed-off-by: Paolo Bonzini <[email protected]> (cherry picked from commit cfa6e2c52ca8f756461fe41f4ce40e61a82fd914) Signed-off-by: Michael Tokarev <[email protected]> diff --git a/hw/i386/vapic.c b/hw/i386/vapic.c index 2069a4b962a..c914d96d946 100644 --- a/hw/i386/vapic.c +++ b/hw/i386/vapic.c @@ -608,11 +608,13 @@ static int vapic_map_rom_writable(VAPICROMState *s) /* read ROM size from RAM region */ if (rom_paddr + 2 >= memory_region_size(section.mr)) { + memory_region_unref(section.mr); return -1; } ram = memory_region_get_ram_ptr(section.mr); rom_size = ram[rom_paddr + 2] * ROM_BLOCK_SIZE; if (rom_size == 0 || rom_size > OPTION_ROM_END - rom_paddr) { + memory_region_unref(section.mr); return -1; } -- 2.47.3
