From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ian Campbell Subject: Re: Re: [PATCH] xen: fix off-by-one error in find_unbound_irq Date: Fri, 26 Feb 2010 21:21:27 +0000 Message-ID: <1267219287.2488.27.camel@localhost.localdomain> References: <1267181975-14348-1-git-send-email-ian.campbell@citrix.com> <1267183329.11737.12225.camel@zakaz.uk.xensource.com> <4B882B72.3000207@goop.org> Mime-Version: 1.0 Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <4B882B72.3000207@goop.org> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: Jeremy Fitzhardinge Cc: "xen-devel@lists.xensource.com" , Jeremy, Fitzhardinge , Konrad Rzeszutek Wilk List-Id: xen-devel@lists.xenproject.org On Fri, 2010-02-26 at 20:13 +0000, Jeremy Fitzhardinge wrote: > On 02/26/2010 03:22 AM, Ian Campbell wrote: > > BTW, this is against xen/master, the original patch isn't in xen/next. > > > > Looks like it came from the pcifront branch which isn't in xen/next yet. Makes sense. I don't think my fix is right though, exiting that loop with irq == nr_irqs - 1 can be valid if the test in first iteration succeeds and we break out The error case is when start == nr_irqs which means we do no iterations of the loop at all but still exit with irq == nr_irqs - 1. Ian. > > J > > > On Fri, 2010-02-26 at 10:59 +0000, Ian Campbell wrote: > > > >> e459de95 "Find an unbound irq number in reverse order (high to low)" introduced > >> an off by one error which would cause repeated allocations of the nr_irq'th IRQ > >> if there are no spare interrupts (i.e. get_nr_hw_irqs() == nr_irqs). > >> > >> Signed-off-by: Ian Campbell > >> Cc: Konrad Rzeszutek Wilk > >> Cc: Jeremy Fitzhardinge > >> --- > >> drivers/xen/events.c | 2 +- > >> 1 files changed, 1 insertions(+), 1 deletions(-) > >> > >> diff --git a/drivers/xen/events.c b/drivers/xen/events.c > >> index 99f2b2a..5c64e1d 100644 > >> --- a/drivers/xen/events.c > >> +++ b/drivers/xen/events.c > >> @@ -377,7 +377,7 @@ static int find_unbound_irq(void) > >> if (irq_info[irq].type == IRQT_UNBOUND) > >> break; > >> > >> - if (irq == start || irq == nr_irqs) > >> + if (irq == start || irq == nr_irqs - 1) > >> panic("No available IRQ to bind to: increase nr_irqs!\n"); > >> > >> desc = irq_to_desc_alloc_node(irq, 0); > >> > > > > > > _______________________________________________ > > Xen-devel mailing list > > Xen-devel@lists.xensource.com > > http://lists.xensource.com/xen-devel > > > > >