1 files changed, 20 insertions, 6 deletions

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index f5283438ee05..1cc6e2e19982 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -671,6 +671,7 @@ static void update_memslots(struct kvm_memslots *slots,
 
         WARN_ON(mslots[i].id != id);
         if (!new->npages) {
+                WARN_ON(!mslots[i].npages);
                 new->base_gfn = 0;
                 if (mslots[i].npages)
                         slots->used_slots--;
@@ -687,12 +688,25 @@ static void update_memslots(struct kvm_memslots *slots,
                 slots->id_to_index[mslots[i].id] = i;
                 i++;
         }
-        while (i > 0 &&
-               new->base_gfn > mslots[i - 1].base_gfn) {
-                mslots[i] = mslots[i - 1];
-                slots->id_to_index[mslots[i].id] = i;
-                i--;
-        }
+
+        /*
+         * The ">=" is needed when creating a slot with base_gfn == 0,
+         * so that it moves before all those with base_gfn == npages == 0.
+         *
+         * On the other hand, if new->npages is zero, the above loop has
+         * already left i pointing to the beginning of the empty part of
+         * mslots, and the ">=" would move the hole backwards in this
+         * case---which is wrong.  So skip the loop when deleting a slot.
+         */
+        if (new->npages) {
+                while (i > 0 &&
+                       new->base_gfn >= mslots[i - 1].base_gfn) {
+                        mslots[i] = mslots[i - 1];
+                        slots->id_to_index[mslots[i].id] = i;
+                        i--;
+                }
+        } else
+                WARN_ON_ONCE(i != slots->used_slots);
 
         mslots[i] = *new;
         slots->id_to_index[mslots[i].id] = i;