Commit 74dcc3f9 authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'stable/for-linus-3.7-rc6-tag' of...

Merge tag 'stable/for-linus-3.7-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen

Pull Xen bug-fix from Konrad Rzeszutek Wilk:
 - Fix regression introduced by commit ceb90fa0 ("xen/privcmd: add
   PRIVCMD_MMAPBATCH_V2 ioctl").

* tag 'stable/for-linus-3.7-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  xen/privcmd: Correctly return success from IOCTL_PRIVCMD_MMAPBATCH
parents 87885b70 68fa965d
...@@ -361,13 +361,13 @@ static long privcmd_ioctl_mmap_batch(void __user *udata, int version) ...@@ -361,13 +361,13 @@ static long privcmd_ioctl_mmap_batch(void __user *udata, int version)
down_write(&mm->mmap_sem); down_write(&mm->mmap_sem);
vma = find_vma(mm, m.addr); vma = find_vma(mm, m.addr);
ret = -EINVAL;
if (!vma || if (!vma ||
vma->vm_ops != &privcmd_vm_ops || vma->vm_ops != &privcmd_vm_ops ||
(m.addr != vma->vm_start) || (m.addr != vma->vm_start) ||
((m.addr + (nr_pages << PAGE_SHIFT)) != vma->vm_end) || ((m.addr + (nr_pages << PAGE_SHIFT)) != vma->vm_end) ||
!privcmd_enforce_singleshot_mapping(vma)) { !privcmd_enforce_singleshot_mapping(vma)) {
up_write(&mm->mmap_sem); up_write(&mm->mmap_sem);
ret = -EINVAL;
goto out; goto out;
} }
...@@ -383,12 +383,16 @@ static long privcmd_ioctl_mmap_batch(void __user *udata, int version) ...@@ -383,12 +383,16 @@ static long privcmd_ioctl_mmap_batch(void __user *udata, int version)
up_write(&mm->mmap_sem); up_write(&mm->mmap_sem);
if (state.global_error && (version == 1)) { if (version == 1) {
/* Write back errors in second pass. */ if (state.global_error) {
state.user_mfn = (xen_pfn_t *)m.arr; /* Write back errors in second pass. */
state.err = err_array; state.user_mfn = (xen_pfn_t *)m.arr;
ret = traverse_pages(m.num, sizeof(xen_pfn_t), state.err = err_array;
&pagelist, mmap_return_errors_v1, &state); ret = traverse_pages(m.num, sizeof(xen_pfn_t),
&pagelist, mmap_return_errors_v1, &state);
} else
ret = 0;
} else if (version == 2) { } else if (version == 2) {
ret = __copy_to_user(m.err, err_array, m.num * sizeof(int)); ret = __copy_to_user(m.err, err_array, m.num * sizeof(int));
if (ret) if (ret)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment