[Xen-changelog] [xen-unstable] x86: Fix get_page() to not drop reference count if it wasn't incremented.

[Xen patchbot-unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User Keir Fraser <keir.fraser@xxxxxxxxxx>
# Date 1237303760 0
# Node ID e655cb27d0857cb4ad45da1fbcef2824706d392e
# Parent  c09a815400801bdbc933a6b6139ffaa1ec342ea5
x86: Fix get_page() to not drop reference count if it wasn't incremented.

Signed-off-by: Keir Fraser <keir.fraser@xxxxxxxxxx>
---
 xen/arch/x86/mm.c |   12 ++++++++----
 1 files changed, 8 insertions(+), 4 deletions(-)

diff -r c09a81540080 -r e655cb27d085 xen/arch/x86/mm.c
--- a/xen/arch/x86/mm.c Tue Mar 17 14:32:52 2009 +0000
+++ b/xen/arch/x86/mm.c Tue Mar 17 15:29:20 2009 +0000
@@ -1948,9 +1948,12 @@ struct domain *page_get_owner_and_refere
 
     do {
         x = y;
-        if ( unlikely((x & PGC_count_mask) == 0) ||  /* Not allocated? */
-             /* Keep one spare reference to be acquired by get_page_light(). */
-             unlikely(((x + 2) & PGC_count_mask) <= 1) ) /* Overflow? */
+        /*
+         * Count ==  0: Page is not allocated, so we cannot take a reference.
+         * Count == -1: Reference count would wrap, which is invalid. 
+         * Count == -2: Remaining unused ref is reserved for get_page_light().
+         */
+        if ( unlikely(((x + 2) & PGC_count_mask) <= 2) )
             return NULL;
     }
     while ( (y = cmpxchg(&page->count_info, x, x + 1)) != x );
@@ -1966,7 +1969,8 @@ int get_page(struct page_info *page, str
     if ( likely(owner == domain) )
         return 1;
 
-    put_page(page);
+    if ( owner != NULL )
+        put_page(page);
 
     if ( !_shadow_mode_refcounts(domain) && !domain->is_dying )
         gdprintk(XENLOG_INFO,

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog