diff options
| author | Michael S. Tsirkin <mst@redhat.com> | 2017-04-04 21:04:23 +0300 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2017-04-10 23:27:50 +0300 |
| commit | 8f10d0149fb983aa84a02a92f9c2113d69e23cb8 (patch) | |
| tree | 17826b508a363c624b688d07beccef4aa15020d6 /drivers/virtio | |
| parent | 404a5c392dccf1ebcfc54bc39d2c200eb30f8fff (diff) | |
| download | op-kernel-dev-8f10d0149fb983aa84a02a92f9c2113d69e23cb8.zip op-kernel-dev-8f10d0149fb983aa84a02a92f9c2113d69e23cb8.tar.gz | |
Revert "virtio_pci: fix out of bound access for msix_names"
This reverts commit de85ec8b07f82c8c84de7687f769e74bf4c26a1e.
Follow-up patches will revert 07ec51480b5e ("virtio_pci: use shared
interrupts for virtqueues") that triggered the problem so no need for
this one anymore.
Tested-by: Mike Galbraith <efault@gmx.de>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'drivers/virtio')
| -rw-r--r-- | drivers/virtio/virtio_pci_common.c | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c index 5905349..df548a6 100644 --- a/drivers/virtio/virtio_pci_common.c +++ b/drivers/virtio/virtio_pci_common.c @@ -147,7 +147,7 @@ static int vp_find_vqs_msix(struct virtio_device *vdev, unsigned nvqs, { struct virtio_pci_device *vp_dev = to_vp_device(vdev); const char *name = dev_name(&vp_dev->vdev.dev); - int i, j, err = -ENOMEM, allocated_vectors, nvectors; + int i, err = -ENOMEM, allocated_vectors, nvectors; unsigned flags = PCI_IRQ_MSIX; bool shared = false; u16 msix_vec; @@ -212,7 +212,7 @@ static int vp_find_vqs_msix(struct virtio_device *vdev, unsigned nvqs, if (!vp_dev->msix_vector_map) goto out_disable_config_irq; - allocated_vectors = j = 1; /* vector 0 is the config interrupt */ + allocated_vectors = 1; /* vector 0 is the config interrupt */ for (i = 0; i < nvqs; ++i) { if (!names[i]) { vqs[i] = NULL; @@ -236,19 +236,18 @@ static int vp_find_vqs_msix(struct virtio_device *vdev, unsigned nvqs, continue; } - snprintf(vp_dev->msix_names[j], + snprintf(vp_dev->msix_names[i + 1], sizeof(*vp_dev->msix_names), "%s-%s", dev_name(&vp_dev->vdev.dev), names[i]); err = request_irq(pci_irq_vector(vp_dev->pci_dev, msix_vec), vring_interrupt, IRQF_SHARED, - vp_dev->msix_names[j], vqs[i]); + vp_dev->msix_names[i + 1], vqs[i]); if (err) { /* don't free this irq on error */ vp_dev->msix_vector_map[i] = VIRTIO_MSI_NO_VECTOR; goto out_remove_vqs; } vp_dev->msix_vector_map[i] = msix_vec; - j++; /* * Use a different vector for each queue if they are available, |
