3 files changed, 6 insertions, 2 deletions

diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index d9a3c30eab2e..e3aae6db276f 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -145,7 +145,8 @@ struct kvm_io_range {
 #define NR_IOBUS_DEVS 1000
 
 struct kvm_io_bus {
-        int                   dev_count;
+        int dev_count;
+        int ioeventfd_count;
         struct kvm_io_range range[];
 };
 
diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
index 64ee720b75c7..1550637d1b10 100644
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -753,6 +753,7 @@ kvm_assign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
         if (ret < 0)
                 goto unlock_fail;
 
+        kvm->buses[bus_idx]->ioeventfd_count++;
         list_add_tail(&p->list, &kvm->ioeventfds);
 
         mutex_unlock(&kvm->slots_lock);
@@ -798,6 +799,7 @@ kvm_deassign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
                         continue;
 
                 kvm_io_bus_unregister_dev(kvm, bus_idx, &p->dev);
+                kvm->buses[bus_idx]->ioeventfd_count--;
                 ioeventfd_release(p);
                 ret = 0;
                 break;
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index b547a1ceecbc..1580dd4ace4e 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -2926,7 +2926,8 @@ int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
         struct kvm_io_bus *new_bus, *bus;
 
         bus = kvm->buses[bus_idx];
-        if (bus->dev_count > NR_IOBUS_DEVS - 1)
+        /* exclude ioeventfd which is limited by maximum fd */
+        if (bus->dev_count - bus->ioeventfd_count > NR_IOBUS_DEVS - 1)
                 return -ENOSPC;
 
         new_bus = kzalloc(sizeof(*bus) + ((bus->dev_count + 1) *