Re: [PATCH] Fix loop logic in irq_alloc_virt()
From: Michael Ellerman <hidden>
Date: 2006-08-02 04:20:53
On Wed, 2006-08-02 at 10:48 +1000, Michael Ellerman wrote:
There's a bug in irq_alloc_virt() if it's asked for more than 1 interrupt, if it can't find a slot it might look past the end of the irq_map. I think this is a fix. No one in the kernel actually calls this with count > 1, so it's not critical.
quoted hunk ↗ jump to hunk
Index: to-merge/arch/powerpc/kernel/irq.c ===================================================================--- to-merge.orig/arch/powerpc/kernel/irq.c +++ to-merge/arch/powerpc/kernel/irq.c@@ -745,14 +744,16 @@ unsigned int irq_alloc_virt(struct irq_h /* Look for count consecutive numbers in the allocatable * (non-legacy) space */ - for (i = NUM_ISA_INTERRUPTS; i <= limit; ) { - for (j = i; j < (i + count); j++) - if (irq_map[j].host != NULL) { - i = j + 1; - continue; - } - found = i; - break;
To be clear: the bug is that the continue affects the inner for loop, not the outer one, so i becomes j + 1 and then we continue the inner loop without checking if i is still <= limit. cheers -- Michael Ellerman IBM OzLabs wwweb: http://michael.ellerman.id.au phone: +61 2 6212 1183 (tie line 70 21183) We do not inherit the earth from our ancestors, we borrow it from our children. - S.M.A.R.T Person
Attachments
- signature.asc [application/pgp-signature] 191 bytes