[XEN] Fix domid check in grant tables when re-using an already pinned grant

table entry.

Based on cset 11419 in xen-unstable, originally from Herbert Xu.

Signed-off-by: Steven Smith <sos22@cam.ac.uk>

diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
index 5c2c572c43142e4c1a0466131579e4e160143a0b..0d17e5527ff3f3a4d71c68ac94b15d121fa0d803 100644 (file)
--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -163,6 +163,14 @@ __gnttab_map_grant_ref(
 
     spin_lock(&rd->grant_table->lock);
 
+    /* If already pinned, check the active domid and avoid refcnt overflow. */
+    if ( act->pin &&
+         ((act->domid != ld->domain_id) ||
+          (act->pin & 0x80808080U) != 0) )
+        PIN_FAIL(unlock_out, GNTST_general_error,
+                 "Bad domain (%d != %d), or risk of counter overflow %08x\n",
+                 act->domid, ld->domain_id, act->pin);
+
     if ( !act->pin ||
          (!(op->flags & GNTMAP_readonly) &&
           !(act->pin & (GNTPIN_hstw_mask|GNTPIN_devw_mask))) )
@@ -221,9 +229,6 @@ __gnttab_map_grant_ref(
             act->frame = gmfn_to_mfn(rd, sha->frame);
         }
     }
-    else if ( (act->pin & 0x80808080U) != 0 )
-        PIN_FAIL(unlock_out, ENOSPC,
-                 "Risk of counter overflow %08x\n", act->pin);
 
     if ( op->flags & GNTMAP_device_map )
         act->pin += (op->flags & GNTMAP_readonly) ?