linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] virt/kvm/assigned-dev.c: Set 'dev->irq_source_id' to '-1' after free it
@ 2014-08-08 15:37 Chen Gang
  2014-08-19 15:44 ` Chen Gang
  0 siblings, 1 reply; 6+ messages in thread
From: Chen Gang @ 2014-08-08 15:37 UTC (permalink / raw)
  To: gleb, pbonzini; +Cc: kvm, linux-kernel@vger.kernel.org

As a generic function, deassign_guest_irq() assumes it can be called
even if assign_guest_irq() is not be called successfully (which can be
triggered by ioctl from user mode, indirectly).

So for assign_guest_irq() failure process, need set 'dev->irq_source_id'
to -1 after free 'dev->irq_source_id', or deassign_guest_irq() may free
it again.

Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
---
 virt/kvm/assigned-dev.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/virt/kvm/assigned-dev.c b/virt/kvm/assigned-dev.c
index bf06577..5819a27 100644
--- a/virt/kvm/assigned-dev.c
+++ b/virt/kvm/assigned-dev.c
@@ -526,8 +526,10 @@ static int assign_guest_irq(struct kvm *kvm,
 		dev->irq_requested_type |= guest_irq_type;
 		if (dev->ack_notifier.gsi != -1)
 			kvm_register_irq_ack_notifier(kvm, &dev->ack_notifier);
-	} else
+	} else {
 		kvm_free_irq_source_id(kvm, dev->irq_source_id);
+		dev->irq_source_id = -1;
+	}
 
 	return r;
 }
-- 
1.7.11.7

^ permalink raw reply related	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2014-08-20 11:21 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-08-08 15:37 [PATCH] virt/kvm/assigned-dev.c: Set 'dev->irq_source_id' to '-1' after free it Chen Gang
2014-08-19 15:44 ` Chen Gang
2014-08-19 15:49   ` Paolo Bonzini
2014-08-19 23:58     ` Chen Gang
2014-08-20  0:01       ` Chen Gang
2014-08-20 11:21         ` Chen Gang

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).