[PATCH] x86/platform: fix the MTRR rollback in XENPF_add_memtype

[Yuho Choi <oss.patchbox@xxxxxxxxx>]

If copying the result back to the caller fails, XENPF_add_memtype
tries to undo mtrr_add_page() with mtrr_del_page(ret, 0, 0). By then
ret holds -EFAULT, so mtrr_del_page() looks up an MTRR with base and
size 0 and releases nothing. The register that was added, or whose
usage count was raised, stays in use, and the caller only gets
-EFAULT, without the register number it would need to delete it.

Pass the register number saved in op->u.add_memtype.reg instead.

Fixes: 8ee614278c2d ("[XEN] Fix memtype accessor domctls.")
Signed-off-by: Yuho Choi <oss.patchbox@xxxxxxxxx>
---
Build-tested only (x86_64 defconfig); not run.

 xen/arch/x86/platform_hypercall.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xen/arch/x86/platform_hypercall.c 
b/xen/arch/x86/platform_hypercall.c
index 6dee4922f3..0f3c791fc2 100644
--- a/xen/arch/x86/platform_hypercall.c
+++ b/xen/arch/x86/platform_hypercall.c
@@ -295,7 +295,7 @@ ret_t do_platform_op(
             ret = __copy_field_to_guest(u_xenpf_op, op, u.add_memtype) ?
                   -EFAULT : 0;
             if ( ret != 0 )
-                mtrr_del_page(ret, 0, 0);
+                mtrr_del_page(op->u.add_memtype.reg, 0, 0);
         }
         break;
 
-- 
2.43.0