[PATCH v2] linux_gntshr_munmap: munmap takes a length, not a page count

[David Scott <dave.scott@citrix.com>]

This fixes a bug where if a client shares more than 1 page, the
munmap call fails to clean up everything. A process which does
a lot of sharing and unsharing can run out of resources.

This patch also fixes in-tree callers of
  - xc_gntshr_munmap
  - xc_gnttab_munmap
to supply page counts rather than lengths.

Signed-off-by: David Scott <dave.scott@citrix.com>
---
 tools/libvchan/init.c        |    8 ++++----
 tools/libvchan/io.c          |    4 ++--
 tools/libxc/xc_linux_osdep.c |    2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/tools/libvchan/init.c b/tools/libvchan/init.c
index c080a1c..de10817 100644
--- a/tools/libvchan/init.c
+++ b/tools/libvchan/init.c
@@ -129,9 +129,9 @@ out:
 	return ring_ref;
 out_unmap_left:
 	if (pages_left)
-		xc_gntshr_munmap(ctrl->gntshr, ctrl->read.buffer, pages_left * PAGE_SIZE);
+		xc_gntshr_munmap(ctrl->gntshr, ctrl->read.buffer, pages_left);
 out_ring:
-	xc_gntshr_munmap(ctrl->gntshr, ring, PAGE_SIZE);
+	xc_gntshr_munmap(ctrl->gntshr, ring, 1);
 	ring_ref = -1;
 	ctrl->ring = NULL;
 	ctrl->write.order = ctrl->read.order = 0;
@@ -204,9 +204,9 @@ static int init_gnt_cli(struct libxenvchan *ctrl, int domain, uint32_t ring_ref)
  out_unmap_left:
 	if (ctrl->write.order >= PAGE_SHIFT)
 		xc_gnttab_munmap(ctrl->gnttab, ctrl->write.buffer,
-		                 1 << ctrl->write.order);
+		                 1 << (ctrl->write.order - PAGE_SHIFT));
  out_unmap_ring:
-	xc_gnttab_munmap(ctrl->gnttab, ctrl->ring, PAGE_SIZE);
+	xc_gnttab_munmap(ctrl->gnttab, ctrl->ring, 1);
 	ctrl->ring = 0;
 	ctrl->write.order = ctrl->read.order = 0;
 	rv = -1;
diff --git a/tools/libvchan/io.c b/tools/libvchan/io.c
index 6e6e239..e66bc4e 100644
--- a/tools/libvchan/io.c
+++ b/tools/libvchan/io.c
@@ -365,10 +365,10 @@ void libxenvchan_close(struct libxenvchan *ctrl)
 	if (ctrl->ring) {
 		if (ctrl->is_server) {
 			ctrl->ring->srv_live = 0;
-			xc_gntshr_munmap(ctrl->gntshr, ctrl->ring, PAGE_SIZE);
+			xc_gntshr_munmap(ctrl->gntshr, ctrl->ring, 1);
 		} else {
 			ctrl->ring->cli_live = 0;
-			xc_gnttab_munmap(ctrl->gnttab, ctrl->ring, PAGE_SIZE);
+			xc_gnttab_munmap(ctrl->gnttab, ctrl->ring, 1);
 		}
 	}
 	if (ctrl->event) {
diff --git a/tools/libxc/xc_linux_osdep.c b/tools/libxc/xc_linux_osdep.c
index 86bff3e..a19e4b6 100644
--- a/tools/libxc/xc_linux_osdep.c
+++ b/tools/libxc/xc_linux_osdep.c
@@ -847,7 +847,7 @@ static void *linux_gntshr_share_pages(xc_gntshr *xch, xc_osdep_handle h,
 static int linux_gntshr_munmap(xc_gntshr *xcg, xc_osdep_handle h,
                                void *start_address, uint32_t count)
 {
-    return munmap(start_address, count);
+    return munmap(start_address, count * XC_PAGE_SIZE);
 }
 
 static struct xc_osdep_ops linux_gntshr_ops = {
-- 
1.7.10.4