3 files changed, 46 insertions, 9 deletions

diff --git a/virt/kvm/coalesced_mmio.c b/virt/kvm/coalesced_mmio.c
index 0352f81ecc0b..04d69cd7049b 100644
--- a/virt/kvm/coalesced_mmio.c
+++ b/virt/kvm/coalesced_mmio.c
@@ -92,6 +92,7 @@ static const struct kvm_io_device_ops coalesced_mmio_ops = {
 int kvm_coalesced_mmio_init(struct kvm *kvm)
 {
         struct kvm_coalesced_mmio_dev *dev;
+        int ret;
 
         dev = kzalloc(sizeof(struct kvm_coalesced_mmio_dev), GFP_KERNEL);
         if (!dev)
@@ -100,9 +101,12 @@ int kvm_coalesced_mmio_init(struct kvm *kvm)
         kvm_iodevice_init(&dev->dev, &coalesced_mmio_ops);
         dev->kvm = kvm;
         kvm->coalesced_mmio_dev = dev;
-        kvm_io_bus_register_dev(kvm, &kvm->mmio_bus, &dev->dev);
 
-        return 0;
+        ret = kvm_io_bus_register_dev(kvm, &kvm->mmio_bus, &dev->dev);
+        if (ret < 0)
+                kfree(dev);
+
+        return ret;
 }
 
 int kvm_vm_ioctl_register_coalesced_mmio(struct kvm *kvm,
diff --git a/virt/kvm/ioapic.c b/virt/kvm/ioapic.c
index b91fbb215447..fa05f67423ab 100644
--- a/virt/kvm/ioapic.c
+++ b/virt/kvm/ioapic.c
@@ -342,6 +342,7 @@ static const struct kvm_io_device_ops ioapic_mmio_ops = {
 int kvm_ioapic_init(struct kvm *kvm)
 {
         struct kvm_ioapic *ioapic;
+        int ret;
 
         ioapic = kzalloc(sizeof(struct kvm_ioapic), GFP_KERNEL);
         if (!ioapic)
@@ -350,7 +351,10 @@ int kvm_ioapic_init(struct kvm *kvm)
         kvm_ioapic_reset(ioapic);
         kvm_iodevice_init(&ioapic->dev, &ioapic_mmio_ops);
         ioapic->kvm = kvm;
-        kvm_io_bus_register_dev(kvm, &kvm->mmio_bus, &ioapic->dev);
-        return 0;
+        ret = kvm_io_bus_register_dev(kvm, &kvm->mmio_bus, &ioapic->dev);
+        if (ret < 0)
+                kfree(ioapic);
+
+        return ret;
 }
 
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index fc1b58a72757..9c2fd025b8ae 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -2533,21 +2533,50 @@ int kvm_io_bus_read(struct kvm_io_bus *bus, gpa_t addr, int len, void *val)
         return -EOPNOTSUPP;
 }
 
-void kvm_io_bus_register_dev(struct kvm *kvm, struct kvm_io_bus *bus,
+int kvm_io_bus_register_dev(struct kvm *kvm, struct kvm_io_bus *bus,
                              struct kvm_io_device *dev)
 {
+        int ret;
+
         down_write(&kvm->slots_lock);
-        __kvm_io_bus_register_dev(bus, dev);
+        ret = __kvm_io_bus_register_dev(bus, dev);
         up_write(&kvm->slots_lock);
+
+        return ret;
 }
 
 /* An unlocked version. Caller must have write lock on slots_lock. */
-void __kvm_io_bus_register_dev(struct kvm_io_bus *bus,
-                             struct kvm_io_device *dev)
+int __kvm_io_bus_register_dev(struct kvm_io_bus *bus,
+                              struct kvm_io_device *dev)
 {
-        BUG_ON(bus->dev_count > (NR_IOBUS_DEVS-1));
+        if (bus->dev_count > NR_IOBUS_DEVS-1)
+                return -ENOSPC;
 
         bus->devs[bus->dev_count++] = dev;
+
+        return 0;
+}
+
+void kvm_io_bus_unregister_dev(struct kvm *kvm,
+                               struct kvm_io_bus *bus,
+                               struct kvm_io_device *dev)
+{
+        down_write(&kvm->slots_lock);
+        __kvm_io_bus_unregister_dev(bus, dev);
+        up_write(&kvm->slots_lock);
+}
+
+/* An unlocked version. Caller must have write lock on slots_lock. */
+void __kvm_io_bus_unregister_dev(struct kvm_io_bus *bus,
+                                 struct kvm_io_device *dev)
+{
+        int i;
+
+        for (i = 0; i < bus->dev_count; i++)
+                if (bus->devs[i] == dev) {
+                        bus->devs[i] = bus->devs[--bus->dev_count];
+                        break;
+                }
 }
 
 static struct notifier_block kvm_cpu_notifier = {