powerpc: Fix irq_free_virt by adjusting bounds before loop (4dd60290) · Commits · 戴 / test

Instead of looping over each irq and checking against the irq array bounds, adjust the bounds before looping. The old code will not free any irq if the irq + count is above irq_virq_count because the test in the loop is testing irq + count instead of irq + i. This code checks the limits to avoid unsigned integer overflows. Signed-off-by:

Milton Miller <miltonm@bga.com> Signed-off-by:

Benjamin Herrenschmidt <benh@kernel.crashing.org>

arch/powerpc/kernel/irq.c

+13 −4

Original line number	Diff line number	Diff line
		@@ -1007,14 +1007,23 @@ void irq_free_virt(unsigned int virq, unsigned int count)
		WARN_ON (virq < NUM_ISA_INTERRUPTS);
		WARN_ON (count == 0 \|\| (virq + count) > irq_virq_count);

		if (virq < NUM_ISA_INTERRUPTS) {
		if (virq + count < NUM_ISA_INTERRUPTS)
		return;
		count =- NUM_ISA_INTERRUPTS - virq;
		virq = NUM_ISA_INTERRUPTS;
		}

		if (count > irq_virq_count \|\| virq > irq_virq_count - count) {
		if (virq > irq_virq_count)
		return;
		count = irq_virq_count - virq;
		}

		raw_spin_lock_irqsave(&irq_big_lock, flags);
		for (i = virq; i < (virq + count); i++) {
		struct irq_host *host;

		if (i < NUM_ISA_INTERRUPTS \|\|
		(virq + count) > irq_virq_count)
		continue;

		host = irq_map[i].host;
		irq_map[i].hwirq = host->inval_irq;
		smp_wmb();

Admin message