Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cc36f8e9 authored by Liam Mark's avatar Liam Mark
Browse files

iommu/io-pgtable: fix __arm_lpae_free_pgtable leak 



When unmapping 2MB mappings, which are 2MB aligned, the smmu driver
is leaking the 3rd level page tables.
Fix this leak by updating __arm_lpae_free_pgtable so that it no
longer leaks leaf table entries.

To reproduce this leak simply map and unmap a non-block 2MB mapping
which is 2MB aligned.

Change-Id: Ibdbdb084ceb8d03ebe0a04e8777e3eb9419e9b87
Signed-off-by: default avatarLiam Mark <lmark@codeaurora.org>
parent 75d530af

drivers/iommu/io-pgtable-arm.c

+5 −4
Original line number Diff line number Diff line
@@ -469,10 +469,6 @@ static void __arm_lpae_free_pgtable(struct arm_lpae_io_pgtable *data, int lvl, 
	arm_lpae_iopte *start, *end;

	unsigned long table_size;



	/* Only leaf entries at the last level */

	if (lvl == ARM_LPAE_MAX_LEVELS - 1)

		return;



	if (lvl == ARM_LPAE_START_LVL(data))

		table_size = data->pgd_size;

	else
@@ -481,6 +477,10 @@ static void __arm_lpae_free_pgtable(struct arm_lpae_io_pgtable *data, int lvl, 
	start = ptep;

	end = (void *)ptep + table_size;



	/* Only leaf entries at the last level */

	if (lvl == ARM_LPAE_MAX_LEVELS - 1)

		goto end;



	while (ptep != end) {

		arm_lpae_iopte pte = *ptep++;
@@ -490,6 +490,7 @@ static void __arm_lpae_free_pgtable(struct arm_lpae_io_pgtable *data, int lvl, 
		__arm_lpae_free_pgtable(data, lvl + 1, iopte_deref(pte, data));

	}



end:

	io_pgtable_free_pages_exact(&data->iop.cfg, data->iop.cookie,

				    start, table_size);

}