Commit a62776332cac ("grant_table: harden bound accesses") introduced a
local variable "ref" in map_grant_ref(), but then didn't use it
consistently throughout the function.

Signed-off-by: Jan Beulich <[email protected]>

--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -1324,7 +1324,7 @@ map_grant_ref(
      */
     mt = &maptrack_entry(lgt, handle);
     mt->domid = op->dom;
-    mt->ref   = op->ref;
+    mt->ref   = ref;
     smp_wmb();
     write_atomic(&mt->flags, op->flags);
 
@@ -1366,7 +1366,7 @@ map_grant_ref(
             status = NULL;
     }
 
-    act = active_entry_acquire(rgt, op->ref);
+    act = active_entry_acquire(rgt, ref);
     act->pin -= pin_incr;
 
  unlock_out_clear:


Reply via email to