This fixes a crash caused by picking the wrong memory region in address_space_lookup_region seen with client code accessing a device model that uses alias memory regions. The expensive part of address_space_lookup_region anyway is phys_page_find; performance-wise it is okay to repeat the subsequent subpage lookup.
Signed-off-by: BALATON Zoltan <bala...@eik.bme.hu> Message-Id: <20171114225941.07270745...@zero.eik.bme.hu> Signed-off-by: Paolo Bonzini <pbonz...@redhat.com> --- exec.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/exec.c b/exec.c index 97a24a875e..3bb9fcf257 100644 --- a/exec.c +++ b/exec.c @@ -410,22 +410,16 @@ static MemoryRegionSection *address_space_lookup_region(AddressSpaceDispatch *d, { MemoryRegionSection *section = atomic_read(&d->mru_section); subpage_t *subpage; - bool update; - if (section && section != &d->map.sections[PHYS_SECTION_UNASSIGNED] && - section_covers_addr(section, addr)) { - update = false; - } else { + if (!section || section == &d->map.sections[PHYS_SECTION_UNASSIGNED] || + !section_covers_addr(section, addr)) { section = phys_page_find(d, addr); - update = true; + atomic_set(&d->mru_section, section); } if (resolve_subpage && section->mr->subpage) { subpage = container_of(section->mr, subpage_t, iomem); section = &d->map.sections[subpage->sub_section[SUBPAGE_IDX(addr)]]; } - if (update) { - atomic_set(&d->mru_section, section); - } return section; } -- 2.14.3