Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c331dcf0 authored by Patrick Daly's avatar Patrick Daly
Browse files

dma-iommu: Fix off-by-one error 



Commit 757c370f ("iommu/iova: Sort out rbtree limit_pfn handling")
altered iova->dma_32bit_pfn to be an exlusive limit, meaning it is
greater than the largest valid pfn.

Commit 30e3ad55 ("dma-iommu: Ensure iova is within given range")
derives limit_pfn from the minimum of the device's dma mask, an
inclusive limit, and iova->dma_32bit_pfn, which is now a exlusive limit.

This results in an off by one error, and allows an iova past the end
of the valid address range to be returned.

Change-Id: I591449b3bc4149baf4a70c9587677a028c2132e9
Signed-off-by: default avatarPatrick Daly <pdaly@codeaurora.org>
parent b8f54403

drivers/iommu/dma-iommu.c

+2 −2
Original line number Original line Diff line number Diff line
@@ -436,7 +436,7 @@ static dma_addr_t iommu_dma_alloc_iova(struct iommu_domain *domain, 
	 * rb_tree.

	 * rb_tree.

	 */

	 */

	limit = min_t(dma_addr_t, DMA_BIT_MASK(32) >> shift,

	limit = min_t(dma_addr_t, DMA_BIT_MASK(32) >> shift,

						iovad->dma_32bit_pfn);

						iovad->dma_32bit_pfn - 1);





	/* Try to get PCI devices a SAC address */

	/* Try to get PCI devices a SAC address */

	if (dma_limit > DMA_BIT_MASK(32) && dev_is_pci(dev))

	if (dma_limit > DMA_BIT_MASK(32) && dev_is_pci(dev))
@@ -444,7 +444,7 @@ static dma_addr_t iommu_dma_alloc_iova(struct iommu_domain *domain, 




	if (!iova) {

	if (!iova) {

		limit = min_t(dma_addr_t, dma_limit >> shift,

		limit = min_t(dma_addr_t, dma_limit >> shift,

						iovad->dma_32bit_pfn);

						iovad->dma_32bit_pfn - 1);





		iova = alloc_iova_fast(iovad, iova_len, limit);

		iova = alloc_iova_fast(iovad, iova_len, limit);

	}

	}