2 files changed, 9 insertions, 2 deletions

diff --git a/drivers/lguest/lguest_device.c b/drivers/lguest/lguest_device.c
index 8904f72f97c6..66f38722253a 100644
--- a/drivers/lguest/lguest_device.c
+++ b/drivers/lguest/lguest_device.c
@@ -200,7 +200,8 @@ static struct virtqueue *lg_find_vq(struct virtio_device *vdev,
 
         /* Figure out how many pages the ring will take, and map that memory */
         lvq->pages = lguest_map((unsigned long)lvq->config.pfn << PAGE_SHIFT,
-                                DIV_ROUND_UP(vring_size(lvq->config.num),
+                                DIV_ROUND_UP(vring_size(lvq->config.num,
+                                                        PAGE_SIZE),
                                              PAGE_SIZE));
         if (!lvq->pages) {
                 err = -ENOMEM;
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 0e1bf053d8cd..1dc04b6684e6 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -277,11 +277,17 @@ struct virtqueue *vring_new_virtqueue(unsigned int num,
         struct vring_virtqueue *vq;
         unsigned int i;
 
+        /* We assume num is a power of 2. */
+        if (num & (num - 1)) {
+                dev_warn(&vdev->dev, "Bad virtqueue length %u\n", num);
+                return NULL;
+        }
+
         vq = kmalloc(sizeof(*vq) + sizeof(void *)*num, GFP_KERNEL);
         if (!vq)
                 return NULL;
 
-        vring_init(&vq->vring, num, pages);
+        vring_init(&vq->vring, num, pages, PAGE_SIZE);
         vq->vq.callback = callback;
         vq->vq.vdev = vdev;
         vq->vq.vq_ops = &vring_vq_ops;