From: Julien Grall <julien.grall@linaro.org>
Date: Tue, 1 Jul 2014 15:16:55 +0000 (+0100)
Subject: xen/arm: Drop reference on foreign page when guest_physmap_add_entry has failed
X-Git-Tag: 4.5.0-rc1~558
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=cc184e82a2522ef188abffc779dd1cd009fa9cc1;p=xen.git

xen/arm: Drop reference on foreign page when guest_physmap_add_entry has failed

When a foreign page is added to the guest p2m, we take a reference on this page.
Currently if the mapping has failed when a leak a reference, this will result
to the guest will foreign guest will became a zombie as soon as it's destroyed.

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
---

diff --git a/xen/arch/arm/mm.c b/xen/arch/arm/mm.c
index 7e8e06ad67..03a05334be 100644
--- a/xen/arch/arm/mm.c
+++ b/xen/arch/arm/mm.c
@@ -994,6 +994,7 @@ int xenmem_add_to_physmap_one(
     unsigned long mfn = 0;
     int rc;
     p2m_type_t t;
+    struct page_info *page = NULL;
 
     switch ( space )
     {
@@ -1041,7 +1042,6 @@ int xenmem_add_to_physmap_one(
     case XENMAPSPACE_gmfn_foreign:
     {
         struct domain *od;
-        struct page_info *page;
         p2m_type_t p2mt;
         od = rcu_lock_domain_by_any_id(foreign_domid);
         if ( od == NULL )
@@ -1091,6 +1091,14 @@ int xenmem_add_to_physmap_one(
     /* Map at new location. */
     rc = guest_physmap_add_entry(d, gpfn, mfn, 0, t);
 
+    /* If we fail to add the mapping, we need to drop the reference we
+     * took earlier on foreign pages */
+    if ( rc && space == XENMAPSPACE_gmfn_foreign )
+    {
+        ASSERT(page != NULL);
+        put_page(page);
+    }
+
     return rc;
 }