From dc4972a4e2f3fee1663bd0670dfc4cd798d5f9b2 Mon Sep 17 00:00:00 2001 From: Ian Campbell Date: Fri, 4 Mar 2011 17:38:21 +0000 Subject: [PATCH] xen/p2m/m2p/gnttab: do not add failed grant maps to m2p override The caller will not undo a mapping which failed and therefore the override will not be removed. This is especially bad in the case of GNTMAP_contains_pte mapping type mappings where m2p_add_override will destroy the kernel mapping of the page. This was observed via a failure of map_grant_pages in gntdev_mmap (due to userspace using a bad grant reference), which left the page in question unmapped (because it was a GNTMAP_contains_pte mapping) which led to a crash later on. Signed-off-by: Ian Campbell Cc: Daniel De Graaf Cc: Stefano Stabellini Cc: Jeremy Fitzhardinge Signed-off-by: Konrad Rzeszutek Wilk --- drivers/xen/grant-table.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c index 9428ced0480..3745a318def 100644 --- a/drivers/xen/grant-table.c +++ b/drivers/xen/grant-table.c @@ -462,6 +462,10 @@ int gnttab_map_refs(struct gnttab_map_grant_ref *map_ops, return ret; for (i = 0; i < count; i++) { + /* Do not add to override if the map failed. */ + if (map_ops[i].status) + continue; + /* m2p override only supported for GNTMAP_contains_pte mappings */ if (!(map_ops[i].flags & GNTMAP_contains_pte)) continue; -- 2.11.4.GIT