提交 e1251465 编写于 作者: M Michael Ellerman 提交者: Paul Mackerras

[POWERPC] Fix loop logic in irq_alloc_virt()

There's a bug in irq_alloc_virt() if it's asked for more than 1 interrupt,
if it can't find a slot it might look past the end of the irq_map.
To be clear: the bug is that the continue affects the inner for loop,
not the outer one, so i becomes j + 1 and then we continue the inner
loop without checking if i is still <= limit.

This fixes it. No one in the kernel actually calls this with count >
1, so it's not critical.
Signed-off-by: NMichael Ellerman <michael@ellerman.id.au>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NPaul Mackerras <paulus@samba.org>
上级 94983cb7
......@@ -777,7 +777,6 @@ unsigned int irq_alloc_virt(struct irq_host *host,
{
unsigned long flags;
unsigned int i, j, found = NO_IRQ;
unsigned int limit = irq_virq_count - count;
if (count == 0 || count > (irq_virq_count - NUM_ISA_INTERRUPTS))
return NO_IRQ;
......@@ -794,14 +793,16 @@ unsigned int irq_alloc_virt(struct irq_host *host,
/* Look for count consecutive numbers in the allocatable
* (non-legacy) space
*/
for (i = NUM_ISA_INTERRUPTS; i <= limit; ) {
for (j = i; j < (i + count); j++)
if (irq_map[j].host != NULL) {
i = j + 1;
continue;
}
found = i;
break;
for (i = NUM_ISA_INTERRUPTS, j = 0; i < irq_virq_count; i++) {
if (irq_map[i].host != NULL)
j = 0;
else
j++;
if (j == count) {
found = i - count + 1;
break;
}
}
if (found == NO_IRQ) {
spin_unlock_irqrestore(&irq_big_lock, flags);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册