Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-15 00:21:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

xen/gntalloc: fix oops after runnning out of grant refs

Browse Source 
Only set gref->gref_id if foreign access was successfully granted and
the grant ref is valid.

If gref->gref_id == -ENOSPC the test in __del_gref() would incorrectly
attempt to end foreign access (because grant_ref_t is unsigned).

Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Reported-by: Dave Scott <dave.scott@citrix.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
This commit is contained in:
David Vrabel 2014-09-02 15:21:29 +01:00
parent 3dcf63677d
commit e9de2e5fd6
1 changed files with 4 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/xen/gntalloc.c
View File

@ -141,13 +141,11 @@ static int add_grefs(struct ioctl_gntalloc_alloc_gref *op,
goto undo;
/* Grant foreign access to the page. */
gref->gref_id = gnttab_grant_foreign_access(op->domid,
rc = gnttab_grant_foreign_access(op->domid,
pfn_to_mfn(page_to_pfn(gref->page)), readonly);
if ((int)gref->gref_id < 0) {
rc = gref->gref_id;
if (rc < 0)
goto undo;
}
gref_ids[i] = gref->gref_id;
gref_ids[i] = gref->gref_id = rc;
}
/* Add to gref lists. */
@ -193,7 +191,7 @@ static void __del_gref(struct gntalloc_gref *gref)
gref->notify.flags = 0;
if (gref->gref_id > 0) {
if (gref->gref_id) {
if (gnttab_query_foreign_access(gref->gref_id))
return;