[GITLAB] - UPGRADE TO v12 on Wednesday the 18th of December at 11.30AM

  • Alex Williamson's avatar
    intel-iommu: fix off-by-one in pagetable freeing · 32df365d
    Alex Williamson authored
    commit 08336fd218e087cc4fcc458e6b6dcafe8702b098 upstream.
    
    dma_pte_free_level() has an off-by-one error when checking whether a pte
    is completely covered by a range.  Take for example the case of
    attempting to free pfn 0x0 - 0x1ff, ie.  512 entries covering the first
    2M superpage.
    
    The level_size() is 0x200 and we test:
    
      static void dma_pte_free_level(...
    	...
    
    	if (!(0 > 0 || 0x1ff < 0 + 0x200)) {
    		...
    	}
    
    Clearly the 2nd test is true, which means we fail to take the branch to
    clear and free the pagetable entry.  As a result, we're leaking
    pagetables and failing to install new pages over the range.
    
    This was found with a PCI device assigned to a QEMU guest using vfio-pci
    without a VGA device present.  The first 1M of guest address space is
    mapped with various combinations of 4K pages, but eventually the range
    is entirely freed and replaced with a 2M contiguous mapping.
    intel-iommu errors out with something like:
    
      ERROR: DMA PTE for vPFN 0x0 already set (to 5c2b8003 not 849c00083)
    
    In this case 5c2b8003 is the pointer to the previous leaf page that was
    neither freed nor cleared and 849c00083 is the superpage entry that
    we're trying to replace it with.
    Signed-off-by: 's avatarAlex Williamson <alex.williamson@redhat.com>
    Cc: David Woodhouse <dwmw2@infradead.org>
    Cc: Joerg Roedel <joro@8bytes.org>
    Signed-off-by: 's avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: 's avatarLinus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    32df365d
Name
Last commit
Last update
..
Kconfig Loading commit data...
Makefile Loading commit data...
amd_iommu.c Loading commit data...
amd_iommu_init.c Loading commit data...
amd_iommu_proto.h Loading commit data...
amd_iommu_types.h Loading commit data...
amd_iommu_v2.c Loading commit data...
dmar.c Loading commit data...
exynos-iommu.c Loading commit data...
intel-iommu.c Loading commit data...
intel_irq_remapping.c Loading commit data...
iommu.c Loading commit data...
iova.c Loading commit data...
irq_remapping.c Loading commit data...
irq_remapping.h Loading commit data...
msm_iommu.c Loading commit data...
msm_iommu_dev.c Loading commit data...
of_iommu.c Loading commit data...
omap-iommu-debug.c Loading commit data...
omap-iommu.c Loading commit data...
omap-iommu.h Loading commit data...
omap-iommu2.c Loading commit data...
omap-iopgtable.h Loading commit data...
omap-iovmm.c Loading commit data...
pci.h Loading commit data...
shmobile-iommu.c Loading commit data...
shmobile-ipmmu.c Loading commit data...
shmobile-ipmmu.h Loading commit data...
tegra-gart.c Loading commit data...
tegra-smmu.c Loading commit data...