From mboxrd@z Thu Jan  1 00:00:00 1970
From: Igor Mammedov <imammedo@redhat.com>
Subject: [Xen HV PATCH] VT-d: Fix resource leaks on error paths
Date: Wed, 11 May 2011 13:45:54 +0200
Message-ID: <1305114354-14907-1-git-send-email-imammedo@redhat.com>
Return-path: <xen-devel-bounces@lists.xensource.com>
List-Unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xensource.com>
List-Help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-Subscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
Sender: xen-devel-bounces@lists.xensource.com
Errors-To: xen-devel-bounces@lists.xensource.com
To: xen-devel@lists.xensource.com
Cc: rhkernel-list@redhat.com
List-Id: xen-devel@lists.xenproject.org

      On error exit from function, maped pages should be unmapped
      and acquired locks released.

diff -r 4b0692880dfa -r da93d9e43b3c xen/drivers/passthrough/vtd/intremap.c
--- a/xen/drivers/passthrough/vtd/intremap.c	Thu May 05 17:40:34 2011 +0100
+++ b/xen/drivers/passthrough/vtd/intremap.c	Wed May 11 12:29:54 2011 +0200
@@ -210,7 +210,8 @@
     if ( iremap_entries )
         unmap_vtd_domain_page(iremap_entries);
 
-    ir_ctrl->iremap_num++;
+    if ( i < IREMAP_ENTRY_NR ) 
+	    ir_ctrl->iremap_num++;
     return i;
 }
 
@@ -246,6 +247,8 @@
         dprintk(XENLOG_ERR VTDPREFIX,
                 "%s: index (%d) get an empty entry!\n",
                 __func__, index);
+	unmap_vtd_domain_page(iremap_entries);
+	spin_unlock_irqrestore(&ir_ctrl->iremap_lock, flags);
         return -EFAULT;
     }
 
@@ -281,7 +284,8 @@
     if ( index < 0 )
     {
         index = alloc_remap_entry(iommu);
-        apic_pin_2_ir_idx[apic][ioapic_pin] = index;
+        if ( index < IREMAP_ENTRY_NR )
+            apic_pin_2_ir_idx[apic][ioapic_pin] = index;
     }
 
     if ( index > IREMAP_ENTRY_NR - 1 )
@@ -546,6 +550,8 @@
         dprintk(XENLOG_ERR VTDPREFIX,
                 "%s: index (%d) get an empty entry!\n",
                 __func__, index);
+	unmap_vtd_domain_page(iremap_entries);
+	spin_unlock_irqrestore(&ir_ctrl->iremap_lock, flags);
         return -EFAULT;
     }