diff mbox

[v2] memory: reduce heap Rss size around 3M

Message ID 1489153475-14888-1-git-send-email-yang.zhong@intel.com
State New
Headers show

Commit Message

Yang Zhong March 10, 2017, 1:44 p.m. UTC
Since cpu-memory and memory have same address space,one malloced
memory is enough. This patch will skip memory malloc for memory
address space,which will reduce around 3M physical memory in heap.

Signed-off-by: Yang Zhong <yang.zhong@intel.com>
---
 memory.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Paolo Bonzini March 10, 2017, 8:40 a.m. UTC | #1
On 10/03/2017 14:44, Yang Zhong wrote:
> Since cpu-memory and memory have same address space,one malloced
> memory is enough. This patch will skip memory malloc for memory
> address space,which will reduce around 3M physical memory in heap.
> 
> Signed-off-by: Yang Zhong <yang.zhong@intel.com>
> ---
>  memory.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/memory.c b/memory.c
> index 284894b..6af80e7 100644
> --- a/memory.c
> +++ b/memory.c
> @@ -2422,7 +2422,7 @@ AddressSpace *address_space_init_shareable(MemoryRegion *root, const char *name)
>      AddressSpace *as;
>  
>      QTAILQ_FOREACH(as, &address_spaces, address_spaces_link) {
> -        if (root == as->root && as->malloced) {
> +        if (root == as->root) {
>              as->ref_count++;
>              return as;
>          }
> 

This has the same problem as v1.

If as->malloced is false, the AddressSpace might be embedded in another
struct.  This other struct could be freed when as->ref_count is still
greater than 0, causing a use-after-free bug.

Paolo
diff mbox

Patch

diff --git a/memory.c b/memory.c
index 284894b..6af80e7 100644
--- a/memory.c
+++ b/memory.c
@@ -2422,7 +2422,7 @@  AddressSpace *address_space_init_shareable(MemoryRegion *root, const char *name)
     AddressSpace *as;
 
     QTAILQ_FOREACH(as, &address_spaces, address_spaces_link) {
-        if (root == as->root && as->malloced) {
+        if (root == as->root) {
             as->ref_count++;
             return as;
         }