@@ -1356,7 +1356,7 @@ static void memory_region_add_subregion_common(MemoryRegion *mr,
assert(!subregion->parent);
subregion->parent = mr;
subregion->addr = offset;
-
+ memory_region_get(subregion);
qemu_mutex_lock(&mem_map_lock);
QTAILQ_FOREACH(other, &mr->subregions, subregions_link) {
if (subregion->may_overlap || other->may_overlap) {
@@ -1420,6 +1420,8 @@ void memory_region_del_subregion(MemoryRegion *mr,
qemu_mutex_lock(&mem_map_lock);
QTAILQ_REMOVE(&mr->subregions, subregion, subregions_link);
memory_region_update_topology(mr);
+ /* mr may be still in use by reader of radix, must delay to release */
+ memory_region_put(subregion);
qemu_mutex_unlock(&mem_map_lock);
}