[Xen-devel] [PATCH v2] linux_gntshr_munmap: munmap takes a length, not a page count

[David Scott <dave.scott@xxxxxxxxxx>]

This fixes a bug where if a client shares more than 1 page, the
munmap call fails to clean up everything. A process which does
a lot of sharing and unsharing can run out of resources.

This patch also fixes in-tree callers of
  - xc_gntshr_munmap
  - xc_gnttab_munmap
to supply page counts rather than lengths.

Signed-off-by: David Scott <dave.scott@xxxxxxxxxx>
---
 tools/libvchan/init.c        |    8 ++++----
 tools/libvchan/io.c          |    4 ++--
 tools/libxc/xc_linux_osdep.c |    2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/tools/libvchan/init.c b/tools/libvchan/init.c
index c080a1c..de10817 100644
--- a/tools/libvchan/init.c
+++ b/tools/libvchan/init.c
@@ -129,9 +129,9 @@ out:
        return ring_ref;
 out_unmap_left:
        if (pages_left)
-               xc_gntshr_munmap(ctrl->gntshr, ctrl->read.buffer, pages_left * 
PAGE_SIZE);
+               xc_gntshr_munmap(ctrl->gntshr, ctrl->read.buffer, pages_left);
 out_ring:
-       xc_gntshr_munmap(ctrl->gntshr, ring, PAGE_SIZE);
+       xc_gntshr_munmap(ctrl->gntshr, ring, 1);
        ring_ref = -1;
        ctrl->ring = NULL;
        ctrl->write.order = ctrl->read.order = 0;
@@ -204,9 +204,9 @@ static int init_gnt_cli(struct libxenvchan *ctrl, int 
domain, uint32_t ring_ref)
  out_unmap_left:
        if (ctrl->write.order >= PAGE_SHIFT)
                xc_gnttab_munmap(ctrl->gnttab, ctrl->write.buffer,
-                                1 << ctrl->write.order);
+                                1 << (ctrl->write.order - PAGE_SHIFT));
  out_unmap_ring:
-       xc_gnttab_munmap(ctrl->gnttab, ctrl->ring, PAGE_SIZE);
+       xc_gnttab_munmap(ctrl->gnttab, ctrl->ring, 1);
        ctrl->ring = 0;
        ctrl->write.order = ctrl->read.order = 0;
        rv = -1;
diff --git a/tools/libvchan/io.c b/tools/libvchan/io.c
index 6e6e239..e66bc4e 100644
--- a/tools/libvchan/io.c
+++ b/tools/libvchan/io.c
@@ -365,10 +365,10 @@ void libxenvchan_close(struct libxenvchan *ctrl)
        if (ctrl->ring) {
                if (ctrl->is_server) {
                        ctrl->ring->srv_live = 0;
-                       xc_gntshr_munmap(ctrl->gntshr, ctrl->ring, PAGE_SIZE);
+                       xc_gntshr_munmap(ctrl->gntshr, ctrl->ring, 1);
                } else {
                        ctrl->ring->cli_live = 0;
-                       xc_gnttab_munmap(ctrl->gnttab, ctrl->ring, PAGE_SIZE);
+                       xc_gnttab_munmap(ctrl->gnttab, ctrl->ring, 1);
                }
        }
        if (ctrl->event) {
diff --git a/tools/libxc/xc_linux_osdep.c b/tools/libxc/xc_linux_osdep.c
index 86bff3e..a19e4b6 100644
--- a/tools/libxc/xc_linux_osdep.c
+++ b/tools/libxc/xc_linux_osdep.c
@@ -847,7 +847,7 @@ static void *linux_gntshr_share_pages(xc_gntshr *xch, 
xc_osdep_handle h,
 static int linux_gntshr_munmap(xc_gntshr *xcg, xc_osdep_handle h,
                                void *start_address, uint32_t count)
 {
-    return munmap(start_address, count);
+    return munmap(start_address, count * XC_PAGE_SIZE);
 }
 
 static struct xc_osdep_ops linux_gntshr_ops = {
-- 
1.7.10.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel