[PATCH] Fix loop logic in irq_alloc_virt()

[Michael Ellerman]

On Wed, 2006-08-02 at 10:48 +1000, Michael Ellerman wrote:
> There's a bug in irq_alloc_virt() if it's asked for more than 1 interrupt,
> if it can't find a slot it might look past the end of the irq_map.
> 
> I think this is a fix. No one in the kernel actually calls this with
> count > 1, so it's not critical.

> Index: to-merge/arch/powerpc/kernel/irq.c
> ===================================================================
> --- to-merge.orig/arch/powerpc/kernel/irq.c
> +++ to-merge/arch/powerpc/kernel/irq.c
> @@ -745,14 +744,16 @@ unsigned int irq_alloc_virt(struct irq_h
>  	/* Look for count consecutive numbers in the allocatable
>  	 * (non-legacy) space
>  	 */
> -	for (i = NUM_ISA_INTERRUPTS; i <= limit; ) {
> -		for (j = i; j < (i + count); j++)
> -			if (irq_map[j].host != NULL) {
> -				i = j + 1;
> -				continue;
> -			}
> -		found = i;
> -		break;

To be clear: the bug is that the continue affects the inner for loop,
not the outer one, so i becomes j + 1 and then we continue the inner
loop without checking if i is still <= limit.

cheers

-- 
Michael Ellerman
IBM OzLabs

wwweb: http://michael.ellerman.id.au
phone: +61 2 6212 1183 (tie line 70 21183)

We do not inherit the earth from our ancestors,
we borrow it from our children. - S.M.A.R.T Person
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 191 bytes
Desc: This is a digitally signed message part
URL: <http://lists.ozlabs.org/pipermail/linuxppc-dev/attachments/20060802/d5cc3e6d/attachment.pgp>