ISSUE DESCRIPTION
=================

Code to handle copy operations on transitive grants has built in retry
logic, involving a function reinvoking itself with unchanged
parameters.  Such use assumes that the compiler would also translate
this to a so called "tail call" when generating machine code.
Empirically, this is not commonly the case, allowing for theoretically
unbounded nesting of such function calls.

IMPACT
======

A malicious or buggy guest may be able to crash Xen.  Privilege
escalation and information leaks cannot be ruled out.

VULNERABLE SYSTEMS
==================

All versions of Xen are vulnerable.

MITIGATION
==========

There is no known mitigation.

External References:

http://xenbits.xen.org/xsa/advisory-226.html