powerpc/oprofile: fix potential buffer overrun in op_model_cell.c

[safe/jmp/linux-2.6] / virt / kvm / irq_comm.c

diff --git a/virt/kvm/irq_comm.c b/virt/kvm/irq_comm.c
index fadf440..a0e8880 100644 (file)
--- a/virt/kvm/irq_comm.c
+++ b/virt/kvm/irq_comm.c
@@ -20,6 +20,7 @@
  */
 
 #include <linux/kvm_host.h>
+#include <linux/slab.h>
 #include <trace/events/kvm.h>
 
 #include <asm/msidef.h>
@@ -82,8 +83,6 @@ int kvm_irq_delivery_to_apic(struct kvm *kvm, struct kvm_lapic *src,
        int i, r = -1;
        struct kvm_vcpu *vcpu, *lowest = NULL;
 
-       WARN_ON(!mutex_is_locked(&kvm->irq_lock));
-
        if (irq->dest_mode == 0 && irq->dest_id == 0xff &&
                        kvm_is_dm_lowest_prio(irq))
                printk(KERN_INFO "kvm: apic: phys broadcast and lowest prio\n");
@@ -138,7 +137,7 @@ static int kvm_set_msi(struct kvm_kernel_irq_routing_entry *e,
        return kvm_irq_delivery_to_apic(kvm, NULL, &irq);
 }
 
-/* This should be called with the kvm->irq_lock mutex held
+/*
  * Return value:
  *  < 0   Interrupt was ignored (masked or not delivered for other reasons)
  *  = 0   Interrupt was coalesced (previous irq is still pending)
@@ -153,8 +152,6 @@ int kvm_set_irq(struct kvm *kvm, int irq_source_id, u32 irq, int level)
 
        trace_kvm_set_irq(irq, level, irq_source_id);
 
-       WARN_ON(!mutex_is_locked(&kvm->irq_lock));
-
        /* Not possible to detect if the guest uses the PIC or the
         * IOAPIC.  So set the bit in both. The guest will ignore
         * writes to the unused one.
@@ -219,16 +216,17 @@ int kvm_request_irq_source_id(struct kvm *kvm)
        int irq_source_id;
 
        mutex_lock(&kvm->irq_lock);
-       irq_source_id = find_first_zero_bit(bitmap,
-                               sizeof(kvm->arch.irq_sources_bitmap));
+       irq_source_id = find_first_zero_bit(bitmap, BITS_PER_LONG);
 
-       if (irq_source_id >= sizeof(kvm->arch.irq_sources_bitmap)) {
+       if (irq_source_id >= BITS_PER_LONG) {
                printk(KERN_WARNING "kvm: exhaust allocatable IRQ sources!\n");
-               return -EFAULT;
+               irq_source_id = -EFAULT;
+               goto unlock;
        }
 
        ASSERT(irq_source_id != KVM_USERSPACE_IRQ_SOURCE_ID);
        set_bit(irq_source_id, bitmap);
+unlock:
        mutex_unlock(&kvm->irq_lock);
 
        return irq_source_id;
@@ -242,10 +240,14 @@ void kvm_free_irq_source_id(struct kvm *kvm, int irq_source_id)
 
        mutex_lock(&kvm->irq_lock);
        if (irq_source_id < 0 ||
-           irq_source_id >= sizeof(kvm->arch.irq_sources_bitmap)) {
+           irq_source_id >= BITS_PER_LONG) {
                printk(KERN_ERR "kvm: IRQ source ID out of range!\n");
-               return;
+               goto unlock;
        }
+       clear_bit(irq_source_id, &kvm->arch.irq_sources_bitmap);
+       if (!irqchip_in_kernel(kvm))
+               goto unlock;
+
        for (i = 0; i < KVM_IOAPIC_NUM_PINS; i++) {
                clear_bit(irq_source_id, &kvm->arch.vioapic->irq_states[i]);
                if (i >= 16)
@@ -254,7 +256,7 @@ void kvm_free_irq_source_id(struct kvm *kvm, int irq_source_id)
                clear_bit(irq_source_id, &pic_irqchip(kvm)->irq_states[i]);
 #endif
        }
-       clear_bit(irq_source_id, &kvm->arch.irq_sources_bitmap);
+unlock:
        mutex_unlock(&kvm->irq_lock);
 }
 
@@ -301,6 +303,7 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt,
 {
        int r = -EINVAL;
        int delta;
+       unsigned max_pin;
        struct kvm_kernel_irq_routing_entry *ei;
        struct hlist_node *n;
 
@@ -321,12 +324,15 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt,
                switch (ue->u.irqchip.irqchip) {
                case KVM_IRQCHIP_PIC_MASTER:
                        e->set = kvm_set_pic_irq;
+                       max_pin = 16;
                        break;
                case KVM_IRQCHIP_PIC_SLAVE:
                        e->set = kvm_set_pic_irq;
+                       max_pin = 16;
                        delta = 8;
                        break;
                case KVM_IRQCHIP_IOAPIC:
+                       max_pin = KVM_IOAPIC_NUM_PINS;
                        e->set = kvm_set_ioapic_irq;
                        break;
                default:
@@ -334,7 +340,7 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt,
                }
                e->irqchip.irqchip = ue->u.irqchip.irqchip;
                e->irqchip.pin = ue->u.irqchip.pin + delta;
-               if (e->irqchip.pin >= KVM_IOAPIC_NUM_PINS)
+               if (e->irqchip.pin >= max_pin)
                        goto out;
                rt->chip[ue->u.irqchip.irqchip][e->irqchip.pin] = ue->gsi;
                break;