[Xen-changelog] [xen master] hvm_set_ioreq_page() releases wrong page in error path

[patchbot@xxxxxxx]

commit 16e2a7596e9fc86881c73cef57602b2c88155528
Author:     Paul Durrant <paul.durrant@xxxxxxxxxx>
AuthorDate: Fri May 2 11:46:32 2014 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Fri May 2 11:46:32 2014 +0200

    hvm_set_ioreq_page() releases wrong page in error path
    
    The function calls prepare_ring_for_helper() to acquire a mapping for the
    given gmfn, then checks (under lock) to see if the ioreq page is already
    set up but, if it is, the function then releases the in-use ioreq page
    mapping on the error path rather than the one it just acquired. This patch
    fixes this bug.
    
    Signed-off-by: Paul Durrant <paul.durrant@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
 xen/arch/x86/hvm/hvm.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index ff6a1fd..5290341 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -496,7 +496,7 @@ static int hvm_set_ioreq_page(
 
     if ( (iorp->va != NULL) || d->is_dying )
     {
-        destroy_ring_for_helper(&iorp->va, iorp->page);
+        destroy_ring_for_helper(&va, page);
         spin_unlock(&iorp->lock);
         return -EINVAL;
     }
--
generated by git-patchbot for /home/xen/git/xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog