diff options
| author | Michael Ellerman <michael@ellerman.id.au> | 2006-08-02 10:48:50 +1000 |
|---|---|---|
| committer | Paul Mackerras <paulus@samba.org> | 2006-09-26 15:24:34 +1000 |
| commit | e12514650b167f48e952d50315fd492d01d42988 (patch) | |
| tree | 8ac4f5ca248ef91a1a6550eba64cca2a80a9711b | |
| parent | 94983cb7881dff760d724759105a6f67935b571d (diff) | |
[POWERPC] Fix loop logic in irq_alloc_virt()
There's a bug in irq_alloc_virt() if it's asked for more than 1 interrupt,
if it can't find a slot it might look past the end of the irq_map.
To be clear: the bug is that the continue affects the inner for loop,
not the outer one, so i becomes j + 1 and then we continue the inner
loop without checking if i is still <= limit.
This fixes it. No one in the kernel actually calls this with count >
1, so it's not critical.
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>
| -rw-r--r-- | arch/powerpc/kernel/irq.c | 19 |
1 files changed, 10 insertions, 9 deletions
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c index b4432332341..c3f58f2f9f5 100644 --- a/arch/powerpc/kernel/irq.c +++ b/arch/powerpc/kernel/irq.c @@ -777,7 +777,6 @@ unsigned int irq_alloc_virt(struct irq_host *host, { unsigned long flags; unsigned int i, j, found = NO_IRQ; - unsigned int limit = irq_virq_count - count; if (count == 0 || count > (irq_virq_count - NUM_ISA_INTERRUPTS)) return NO_IRQ; @@ -794,14 +793,16 @@ unsigned int irq_alloc_virt(struct irq_host *host, /* Look for count consecutive numbers in the allocatable * (non-legacy) space */ - for (i = NUM_ISA_INTERRUPTS; i <= limit; ) { - for (j = i; j < (i + count); j++) - if (irq_map[j].host != NULL) { - i = j + 1; - continue; - } - found = i; - break; + for (i = NUM_ISA_INTERRUPTS, j = 0; i < irq_virq_count; i++) { + if (irq_map[i].host != NULL) + j = 0; + else + j++; + + if (j == count) { + found = i - count + 1; + break; + } } if (found == NO_IRQ) { spin_unlock_irqrestore(&irq_big_lock, flags); |