diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 4b5344dc21..96080b3dec 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -3576,8 +3576,7 @@ do_grant_table_op( rc = gnttab_copy(copy, count); if ( rc > 0 ) { - rc = count - rc; - guest_handle_add_offset(copy, rc); + guest_handle_add_offset(copy, count - rc); uop = guest_handle_cast(copy, void); } break; @@ -3644,6 +3643,9 @@ do_grant_table_op( out: if ( rc > 0 || opaque_out != 0 ) { + /* Adjust rc, see gnttab_copy() for why this is needed. */ + if ( cmd == GNTTABOP_copy ) + rc = count - rc; ASSERT(rc < count); ASSERT((opaque_out & GNTTABOP_CMD_MASK) == 0); rc = hypercall_create_continuation(__HYPERVISOR_grant_table_op, "ihi",