From: Zheng Xiang <xiang.zh...@linaro.org>
The elements of kvm_devices_head list are freed in kvm_arm_machine_init_done(),
but we still access these illegal memory in kvm_arm_devlistener_del().
This will cause segment fault when booting guest with MALLOC_PERTURB_=1.
Signed-off-by: Zheng Xiang <xiang.zh...@linaro.org>
Message-id: 20180619075821.9884-1-zhengxia...@huawei.com
Reviewed-by: Peter Maydell <peter.mayd...@linaro.org>
Signed-off-by: Peter Maydell <peter.mayd...@linaro.org>
---
target/arm/kvm.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index 98f50063238..5bf41e151c6 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -256,6 +256,7 @@ static void kvm_arm_machine_init_done(Notifier *notifier,
void *data)
kvm_arm_set_device_addr(kd);
}
memory_region_unref(kd->mr);
+ QSLIST_REMOVE_HEAD(&kvm_devices_head, entries);
g_free(kd);
}
memory_listener_unregister(&devlistener);
--
2.17.1
