evtchn/fifo: map correct pages when guest is HVM

If a HVM guest attempts to use the FIFO-based ABI it will not receive
any events and destroying the guest may crash Xen or trigger an assert
when attempting to unmap a control block page.  This occurs because
Xen maps the wrong page for both the control blocks and the event
arrays.

In map_guest_page(), use the MFN of the guest's page and not the GFN
when calling map_domain_page_global().

Reported-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>

diff --git a/xen/common/event_fifo.c b/xen/common/event_fifo.c
index 6048784bc6f8f4a51d804caa04d15dfcb60a3ffb..b0d3fc2e25e719e3de23c7a9d3cc054ec1a6cde4 100644 (file)
--- a/xen/common/event_fifo.c
+++ b/xen/common/event_fifo.c
@@ -284,7 +284,7 @@ static int map_guest_page(struct domain *d, uint64_t gfn, void **virt)
         return -EINVAL;
     }
 
-    *virt = map_domain_page_global(gfn);
+    *virt = __map_domain_page_global(p);
     if ( !*virt )
     {
         put_page_and_type(p);