i386/vapic: unref MemoryRegion if vapic_map_rom_writable fails
memory_region_find returns the memory region with an elevated reference count. Drop the reference count also if the memory region cannot be mapped writable. Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Paolo Bonzini committed
Aug 26, 2026 at 19:47 UTC
cfa6e2c52ca8f756461fe41f4ce40e61a82fd914
1 file changed
+2
hw/i386/vapic.c
+2
@@ -614,11 +614,13 @@ static int vapic_map_rom_writable(VAPICROMState *s)
614
615
/* read ROM size from RAM region */
616
if (rom_paddr + 2 >= memory_region_size(section.mr)) {
617
+ memory_region_unref(section.mr);
618
return -1;
619
}
620
ram = memory_region_get_ram_ptr(section.mr);
621
rom_size = ram[rom_paddr + 2] * ROM_BLOCK_SIZE;
622
if (rom_size == 0 || rom_size > OPTION_ROM_END - rom_paddr) {
623
+ memory_region_unref(section.mr);
624
return -1;
625
}
626