Commit 30d1e0e8 authored by Chen Gang's avatar Chen Gang Committed by Paolo Bonzini

virt/kvm/assigned-dev.c: Set 'dev->irq_source_id' to '-1' after free it

As a generic function, deassign_guest_irq() assumes it can be called
even if assign_guest_irq() is not be called successfully (which can be
triggered by ioctl from user mode, indirectly).

So for assign_guest_irq() failure process, need set 'dev->irq_source_id'
to -1 after free 'dev->irq_source_id', or deassign_guest_irq() may free
it again.
Signed-off-by: default avatarChen Gang <gang.chen.5i5j@gmail.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 0d234daf
...@@ -526,8 +526,10 @@ static int assign_guest_irq(struct kvm *kvm, ...@@ -526,8 +526,10 @@ static int assign_guest_irq(struct kvm *kvm,
dev->irq_requested_type |= guest_irq_type; dev->irq_requested_type |= guest_irq_type;
if (dev->ack_notifier.gsi != -1) if (dev->ack_notifier.gsi != -1)
kvm_register_irq_ack_notifier(kvm, &dev->ack_notifier); kvm_register_irq_ack_notifier(kvm, &dev->ack_notifier);
} else } else {
kvm_free_irq_source_id(kvm, dev->irq_source_id); kvm_free_irq_source_id(kvm, dev->irq_source_id);
dev->irq_source_id = -1;
}
return r; return r;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment