Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b826ee9a authored by Robin Murphy's avatar Robin Murphy Committed by Joerg Roedel
Browse files

iommu/iova: Make rcache limit_pfn handling more robust 



When popping a pfn from an rcache, we are currently checking it directly
against limit_pfn for viability. Since this represents iova->pfn_lo, it
is technically possible for the corresponding iova->pfn_hi to be greater
than limit_pfn. Although we generally get away with it in practice since
limit_pfn is typically a power-of-two boundary and the IOVAs are
size-aligned, it's pretty trivial to make the iova_rcache_get() path
take the allocation size into account for complete safety.

Signed-off-by: default avatarRobin Murphy <robin.murphy@arm.com>
Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
parent 7595dc58

drivers/iommu/iova.c

+3 −3
Original line number Diff line number Diff line
@@ -406,7 +406,7 @@ alloc_iova_fast(struct iova_domain *iovad, unsigned long size, 
	unsigned long iova_pfn;

	struct iova *new_iova;



	iova_pfn = iova_rcache_get(iovad, size, limit_pfn);

	iova_pfn = iova_rcache_get(iovad, size, limit_pfn + 1);

	if (iova_pfn)

		return iova_pfn;
@@ -823,7 +823,7 @@ static unsigned long iova_magazine_pop(struct iova_magazine *mag, 
{

	BUG_ON(iova_magazine_empty(mag));



	if (mag->pfns[mag->size - 1] >= limit_pfn)

	if (mag->pfns[mag->size - 1] > limit_pfn)

		return 0;



	return mag->pfns[--mag->size];
@@ -977,7 +977,7 @@ static unsigned long iova_rcache_get(struct iova_domain *iovad, 
	if (log_size >= IOVA_RANGE_CACHE_MAX_SIZE)

		return 0;



	return __iova_rcache_get(&iovad->rcaches[log_size], limit_pfn);

	return __iova_rcache_get(&iovad->rcaches[log_size], limit_pfn - size);

}



/*