From 16e2a7596e9fc86881c73cef57602b2c88155528 Mon Sep 17 00:00:00 2001 From: Paul Durrant Date: Fri, 2 May 2014 11:46:32 +0200 Subject: [PATCH] hvm_set_ioreq_page() releases wrong page in error path The function calls prepare_ring_for_helper() to acquire a mapping for the given gmfn, then checks (under lock) to see if the ioreq page is already set up but, if it is, the function then releases the in-use ioreq page mapping on the error path rather than the one it just acquired. This patch fixes this bug. Signed-off-by: Paul Durrant Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper --- xen/arch/x86/hvm/hvm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index ff6a1fd97d..5290341183 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -496,7 +496,7 @@ static int hvm_set_ioreq_page( if ( (iorp->va != NULL) || d->is_dying ) { - destroy_ring_for_helper(&iorp->va, iorp->page); + destroy_ring_for_helper(&va, page); spin_unlock(&iorp->lock); return -EINVAL; } -- 2.30.2