[XEN] Add more checking when reusing an active grant reference.

Signed-off-by: Steven Smith <sos22@cam.ac.uk>
Based-on-a-patch-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
index c8ba26071143c42899fc0ee0dd2a4eaec21f5c66..95d36fce4ea1af0df0d98a6a669c777636afc217 100644 (file)
--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -175,12 +175,13 @@ __gnttab_map_grant_ref(
 
     spin_lock(&rd->grant_table->lock);
 
+    sdom = sha->domid;
+
     if ( !act->pin ||
          (!(op->flags & GNTMAP_readonly) &&
           !(act->pin & (GNTPIN_hstw_mask|GNTPIN_devw_mask))) )
     {
         sflags = sha->flags;
-        sdom   = sha->domid;
 
         /*
          * This loop attempts to set the access (reading/writing) flags
@@ -235,6 +236,10 @@ __gnttab_map_grant_ref(
             act->frame = gmfn_to_mfn(rd, sha->frame);
         }
     }
+    else if ( unlikely(sdom != ld->domain_id) )
+        PIN_FAIL(unlock_out, GNTST_general_error,
+                 "Bad domain (%d). (NB. expected dom %d)\n",
+                 sdom, ld->domain_id);
     else if ( (act->pin & 0x80808080U) != 0 )
         PIN_FAIL(unlock_out, ENOSPC,
                  "Risk of counter overflow %08x\n", act->pin);
@@ -771,11 +776,12 @@ __acquire_grant_for_copy(
 
     spin_lock(&rd->grant_table->lock);
     
+    sdom = sha->domid;
+
     if ( !act->pin ||
          (!readonly && !(act->pin & GNTPIN_hstw_mask)) )
     {
         sflags = sha->flags;
-        sdom = sha->domid;
 
         for ( ; ; )
         {
@@ -819,6 +825,10 @@ __acquire_grant_for_copy(
             act->frame = gmfn_to_mfn(rd, sha->frame);
         }
     }
+    else if ( unlikely(sdom != current->domain->domain_id) )
+        PIN_FAIL(unlock_out, GNTST_general_error,
+                 "Bad domain (%d). (NB. expected dom %d)\n",
+                 sdom, current->domain->domain_id);
     else if ( (act->pin & 0x80808080U) != 0 )
         PIN_FAIL(unlock_out, ENOSPC,
                  "Risk of counter overflow %08x\n", act->pin);