Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 22463cab authored by Laurent Pinchart's avatar Laurent Pinchart
Browse files

iommu/ipmmu-vmsa: Flush P[UM]D entry before freeing the child page table 



When clearing PUD or PMD entries the child page table (if any) is freed
and the PUD or PMD entry is then cleared. This result in a small race
condition window during which a free page table could be accessed by the
IPMMU.

Fix it by clearing and flushing the PUD or PMD entry before freeing the
child page table.

Signed-off-by: default avatarLaurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
parent b8f80bff

drivers/iommu/ipmmu-vmsa.c

+11 −8
Original line number Diff line number Diff line
@@ -678,30 +678,33 @@ static int ipmmu_create_mapping(struct ipmmu_vmsa_domain *domain, 


static void ipmmu_clear_pud(struct ipmmu_vmsa_device *mmu, pud_t *pud)

{

	/* Free the page table. */

	pgtable_t table = pud_pgtable(*pud);

	__free_page(table);



	/* Clear the PUD. */

	*pud = __pud(0);

	ipmmu_flush_pgtable(mmu, pud, sizeof(*pud));



	/* Free the page table. */

	__free_page(table);

}



static void ipmmu_clear_pmd(struct ipmmu_vmsa_device *mmu, pud_t *pud,

			    pmd_t *pmd)

{

	pmd_t pmdval = *pmd;

	unsigned int i;



	/* Free the page table. */

	if (pmd_table(*pmd)) {

		pgtable_t table = pmd_pgtable(*pmd);

		__free_page(table);

	}



	/* Clear the PMD. */

	*pmd = __pmd(0);

	ipmmu_flush_pgtable(mmu, pmd, sizeof(*pmd));



	/* Free the page table. */

	if (pmd_table(pmdval)) {

		pgtable_t table = pmd_pgtable(pmdval);



		__free_page(table);

	}



	/* Check whether the PUD is still needed. */

	pmd = pmd_offset(pud, 0);

	for (i = 0; i < IPMMU_PTRS_PER_PMD; ++i) {