genirq: Use IRQ_BITMAP_BITS as search size in irq_alloc_descs() (ed4dea6e) · Commits · 戴 / test

The runtime expansion of nr_irqs does not take into account that bitmap_find_next_zero_area() returns "start" + size in case the search for an matching zero area fails. That results in a start value which can be completely off and is not covered by the following expand_nr_irqs() and possibly outside of the absolute limit. But we use it without further checking. Use IRQ_BITMAP_BITS as the limit for the bitmap search and expand nr_irqs when the start bit is beyond nr_irqs. So start is always pointing to the correct area in the bitmap. nr_irqs is just the limit for irq enumerations, not the real limit for the irq space. [ tglx: Let irq_expand_nr_irqs() take the new upper end so we do not expand nr_irqs more than necessary. Made changelog readable ] Signed-off-by:

Yinghai Lu <yinghai@kernel.org> LKML-Reference: <4D6014F9.8040605@kernel.org> Signed-off-by:

Thomas Gleixner <tglx@linutronix.de>

kernel/irq/irqdesc.c

+8 −7

Original line number	Diff line number	Diff line
		@@ -207,11 +207,11 @@ struct irq_desc * __ref irq_to_desc_alloc_node(unsigned int irq, int node)
		return NULL;
		}

		static int irq_expand_nr_irqs(unsigned int cnt)
		static int irq_expand_nr_irqs(unsigned int nr)
		{
		if (nr_irqs + cnt > IRQ_BITMAP_BITS)
		if (nr > IRQ_BITMAP_BITS)
		return -ENOMEM;
		nr_irqs += cnt;
		nr_irqs = nr;
		return 0;
		}

		@@ -298,7 +298,7 @@ static inline int alloc_descs(unsigned int start, unsigned int cnt, int node)
		return start;
		}

		static int irq_expand_nr_irqs(unsigned int cnt)
		static int irq_expand_nr_irqs(unsigned int nr)
		{
		return -ENOMEM;
		}
		@@ -346,13 +346,14 @@ irq_alloc_descs(int irq, unsigned int from, unsigned int cnt, int node)

		mutex_lock(&sparse_irq_lock);

		start = bitmap_find_next_zero_area(allocated_irqs, nr_irqs, from, cnt, 0);
		start = bitmap_find_next_zero_area(allocated_irqs, IRQ_BITMAP_BITS,
		from, cnt, 0);
		ret = -EEXIST;
		if (irq >=0 && start != irq)
		goto err;

		if (start >= nr_irqs) {
		ret = irq_expand_nr_irqs(cnt);
		if (start + cnt > nr_irqs) {
		ret = irq_expand_nr_irqs(start + cnt);
		if (ret)
		goto err;
		}

Admin message