[Xen-devel] [PATCH] xen-gntdev: Avoid unmapping ranges twice

[Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>]

In paravirtualized domains, mn_invl_page or mn_invl_range_start can
unmap a segment of a mapped region without unmapping all pages. When
the region is later released, the pages will be unmapped twice, leading
to an incorrect -EINVAL return.

Signed-off-by: Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>
---
 drivers/xen/gntdev.c |   33 +++++++++++++++++++++++++++++++--
 1 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 4ca4262..4687cd5 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -282,7 +282,7 @@ static int map_grant_pages(struct grant_map *map)
        return err;
 }
 
-static int unmap_grant_pages(struct grant_map *map, int offset, int pages)
+static int __unmap_grant_pages(struct grant_map *map, int offset, int pages)
 {
        int i, err = 0;
 
@@ -301,7 +301,6 @@ static int unmap_grant_pages(struct grant_map *map, int 
offset, int pages)
                }
        }
 
-       pr_debug("map %d+%d [%d+%d]\n", map->index, map->count, offset, pages);
        err = gnttab_unmap_refs(map->unmap_ops + offset, map->pages + offset, 
pages);
        if (err)
                return err;
@@ -314,6 +313,36 @@ static int unmap_grant_pages(struct grant_map *map, int 
offset, int pages)
        return err;
 }
 
+static int unmap_grant_pages(struct grant_map *map, int offset, int pages)
+{
+       int range, err = 0;
+
+       pr_debug("unmap %d+%d [%d+%d]\n", map->index, map->count, offset, 
pages);
+
+       /* It is possible the requested range will have a "hole" where we
+        * already unmapped some of the grants. Only unmap valid ranges.
+        */
+       while (pages && !err) {
+               while (pages && !map->unmap_ops[offset].handle) {
+                       offset++;
+                       pages--;
+               }
+               range = 0;
+               while (range < pages) {
+                       if (!map->unmap_ops[offset+range].handle) {
+                               range--;
+                               break;
+                       }
+                       range++;
+               }
+               err = __unmap_grant_pages(map, offset, range);
+               offset += range;
+               pages -= range;
+       }
+
+       return err;
+}
+
 /* ------------------------------------------------------------------ */
 
 static void gntdev_vma_close(struct vm_area_struct *vma)
-- 
1.7.3.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel