mm: guest_remove_page() should not populate or unshare.

guest_remove_page() ought to use get_gfn_query() to look up the
current state of the gfn.  Otherwise it might populate or unshare
the gfn just before dropping it.

Signed-off-by: Tim Deegan <tim@xen.org>
Committed-by: Tim Deegan <tim@xen.org>

diff --git a/xen/common/memory.c b/xen/common/memory.c
index 907c6fdbde36ab0a126f86bcd375fb2e33ea6440..3f02380fdfcb3385ec8d1ed308117e54a676c052 100644 (file)
--- a/xen/common/memory.c
+++ b/xen/common/memory.c
@@ -162,7 +162,7 @@ int guest_remove_page(struct domain *d, unsigned long gmfn)
     unsigned long mfn;
 
 #ifdef CONFIG_X86
-    mfn = mfn_x(get_gfn(d, gmfn, &p2mt)); 
+    mfn = mfn_x(get_gfn_query(d, gmfn, &p2mt)); 
     if ( unlikely(p2m_is_paging(p2mt)) )
     {
         guest_physmap_remove_page(d, gmfn, mfn, 0);