# HG changeset patch
# User yamahata@xxxxxxxxxxxxx
# Node ID 30e807eee6f168b7a9e12e67b36cc669cbdadcf5
# Parent  d0d3fef37685be264a7f52201f8ef44c030daad3
fix mfn check of gnttab_transfer. gop.mfn is gmfn.

Signed-off-by: Isaku Yamahata <yamahata@xxxxxxxxxxxxx>

diff -r d0d3fef37685 -r 30e807eee6f1 xen/common/grant_table.c
--- a/xen/common/grant_table.c	Mon Apr  3 14:34:20 2006 +0100
+++ b/xen/common/grant_table.c	Tue Apr  4 20:04:24 2006 +0900
@@ -618,8 +618,9 @@ gnttab_transfer(
             return -EFAULT;
         }
 
+        mfn = gmfn_to_mfn(d, gop.mfn);
         /* Check the passed page frame for basic validity. */
-        if ( unlikely(!mfn_valid(gop.mfn)) )
+        if ( unlikely(mfn == INVALID_MFN) || unlikely(!mfn_valid(mfn)) )
         { 
             DPRINTK("gnttab_transfer: out-of-range %lx\n",
                     (unsigned long)gop.mfn);
@@ -627,7 +628,6 @@ gnttab_transfer(
             goto copyback;
         }
 
-        mfn = gmfn_to_mfn(d, gop.mfn);
         page = mfn_to_page(mfn);
         if ( unlikely(IS_XEN_HEAP_FRAME(page)) )
         { 
@@ -639,6 +639,7 @@ gnttab_transfer(
 
         if ( steal_page_for_grant_transfer(d, page) < 0 )
         {
+            DPRINTK("steal_page_for_grant_transfer\n");
             gop.status = GNTST_bad_page;
             goto copyback;
         }