Modifying a non-existent slot is not allowed. Also check that the first loop doesn't move a deleted slot beyond the used part of the mslots array.
Unified · Split
| @@ -671,6 +671,7 @@ static void update_memslots(struct kvm_memslots *slots, · 670 unmodified lines | ||
| 671 | 671 | |
| 672 | 672 | WARN_ON(mslots[i].id != id); |
| 673 | 673 | if (!new->npages) { |
| 674 | + WARN_ON(!mslots[i].npages); | |
| 674 | 675 | new->base_gfn = 0; |
| 675 | 676 | if (mslots[i].npages) |
| 676 | 677 | slots->used_slots--; |
| @@ -704,7 +705,8 @@ static void update_memslots(struct kvm_memslots *slots, · 27 unmodified lines | ||
| 704 | 705 | slots->id_to_index[mslots[i].id] = i; |
| 705 | 706 | i--; |
| 706 | 707 | } |
| 707 | − } | |
| 708 | + } else | |
| 709 | + WARN_ON_ONCE(i != slots->used_slots); | |
| 708 | 710 | |
| 709 | 711 | mslots[i] = *new; |
| 710 | 712 | slots->id_to_index[mslots[i].id] = i; |