powerpc/oprofile: fix potential buffer overrun in op_model_cell.c

[safe/jmp/linux-2.6] / virt / kvm / irq_comm.c

diff --git a/virt/kvm/irq_comm.c b/virt/kvm/irq_comm.c
index 15a83b9..a0e8880 100644 (file)
--- a/virt/kvm/irq_comm.c
+++ b/virt/kvm/irq_comm.c
@@ -20,6 +20,7 @@
  */
 
 #include <linux/kvm_host.h>
+#include <linux/slab.h>
 #include <trace/events/kvm.h>
 
 #include <asm/msidef.h>
@@ -215,16 +216,17 @@ int kvm_request_irq_source_id(struct kvm *kvm)
        int irq_source_id;
 
        mutex_lock(&kvm->irq_lock);
-       irq_source_id = find_first_zero_bit(bitmap,
-                               sizeof(kvm->arch.irq_sources_bitmap));
+       irq_source_id = find_first_zero_bit(bitmap, BITS_PER_LONG);
 
-       if (irq_source_id >= sizeof(kvm->arch.irq_sources_bitmap)) {
+       if (irq_source_id >= BITS_PER_LONG) {
                printk(KERN_WARNING "kvm: exhaust allocatable IRQ sources!\n");
-               return -EFAULT;
+               irq_source_id = -EFAULT;
+               goto unlock;
        }
 
        ASSERT(irq_source_id != KVM_USERSPACE_IRQ_SOURCE_ID);
        set_bit(irq_source_id, bitmap);
+unlock:
        mutex_unlock(&kvm->irq_lock);
 
        return irq_source_id;
@@ -238,10 +240,14 @@ void kvm_free_irq_source_id(struct kvm *kvm, int irq_source_id)
 
        mutex_lock(&kvm->irq_lock);
        if (irq_source_id < 0 ||
-           irq_source_id >= sizeof(kvm->arch.irq_sources_bitmap)) {
+           irq_source_id >= BITS_PER_LONG) {
                printk(KERN_ERR "kvm: IRQ source ID out of range!\n");
-               return;
+               goto unlock;
        }
+       clear_bit(irq_source_id, &kvm->arch.irq_sources_bitmap);
+       if (!irqchip_in_kernel(kvm))
+               goto unlock;
+
        for (i = 0; i < KVM_IOAPIC_NUM_PINS; i++) {
                clear_bit(irq_source_id, &kvm->arch.vioapic->irq_states[i]);
                if (i >= 16)
@@ -250,7 +256,7 @@ void kvm_free_irq_source_id(struct kvm *kvm, int irq_source_id)
                clear_bit(irq_source_id, &pic_irqchip(kvm)->irq_states[i]);
 #endif
        }
-       clear_bit(irq_source_id, &kvm->arch.irq_sources_bitmap);
+unlock:
        mutex_unlock(&kvm->irq_lock);
 }
 
@@ -297,6 +303,7 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt,
 {
        int r = -EINVAL;
        int delta;
+       unsigned max_pin;
        struct kvm_kernel_irq_routing_entry *ei;
        struct hlist_node *n;
 
@@ -317,12 +324,15 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt,
                switch (ue->u.irqchip.irqchip) {
                case KVM_IRQCHIP_PIC_MASTER:
                        e->set = kvm_set_pic_irq;
+                       max_pin = 16;
                        break;
                case KVM_IRQCHIP_PIC_SLAVE:
                        e->set = kvm_set_pic_irq;
+                       max_pin = 16;
                        delta = 8;
                        break;
                case KVM_IRQCHIP_IOAPIC:
+                       max_pin = KVM_IOAPIC_NUM_PINS;
                        e->set = kvm_set_ioapic_irq;
                        break;
                default:
@@ -330,7 +340,7 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt,
                }
                e->irqchip.irqchip = ue->u.irqchip.irqchip;
                e->irqchip.pin = ue->u.irqchip.pin + delta;
-               if (e->irqchip.pin >= KVM_IOAPIC_NUM_PINS)
+               if (e->irqchip.pin >= max_pin)
                        goto out;
                rt->chip[ue->u.irqchip.irqchip][e->irqchip.pin] = ue->gsi;
                break;