Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5890358c authored by Alexander Shishkin's avatar Alexander Shishkin Committed by Greg Kroah-Hartman
Browse files

intel_th: Use correct device when freeing buffers 



commit 0ed2424b upstream.

Commit d5c435df ("intel_th: msu: Use the real device in case of IOMMU
domain allocation") changes dma buffer allocation to use the actual
underlying device, but forgets to change the deallocation path, which leads
to (if you've got CAP_SYS_RAWIO):

> # echo 0,0 > /sys/bus/intel_th/devices/0-msc0/nr_pages
> ------------[ cut here ]------------
> kernel BUG at ../linux/drivers/iommu/intel-iommu.c:3670!
> CPU: 3 PID: 231 Comm: sh Not tainted 4.17.0-rc1+ #2729
> RIP: 0010:intel_unmap+0x11e/0x130
...
> Call Trace:
>  intel_free_coherent+0x3e/0x60
>  msc_buffer_win_free+0x100/0x160 [intel_th_msu]

This patch fixes the buffer deallocation code to use the correct device.

Signed-off-by: default avatarAlexander Shishkin <alexander.shishkin@linux.intel.com>
Fixes: d5c435df ("intel_th: msu: Use the real device in case of IOMMU domain allocation")
Reported-by: default avatarBaofeng Tian <baofeng.tian@intel.com>
CC: stable@vger.kernel.org # v4.14+
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 792be048

drivers/hwtracing/intel_th/msu.c

+3 −3
Original line number Original line Diff line number Diff line
@@ -741,8 +741,8 @@ static int msc_buffer_win_alloc(struct msc *msc, unsigned int nr_blocks) 
		/* Reset the page to write-back before releasing */

		/* Reset the page to write-back before releasing */

		set_memory_wb((unsigned long)win->block[i].bdesc, 1);

		set_memory_wb((unsigned long)win->block[i].bdesc, 1);

#endif

#endif

		dma_free_coherent(msc_dev(msc), size, win->block[i].bdesc,

		dma_free_coherent(msc_dev(msc)->parent->parent, size,

				  win->block[i].addr);

				  win->block[i].bdesc, win->block[i].addr);

	}

	}

	kfree(win);

	kfree(win);
@@ -777,7 +777,7 @@ static void msc_buffer_win_free(struct msc *msc, struct msc_window *win) 
		/* Reset the page to write-back before releasing */

		/* Reset the page to write-back before releasing */

		set_memory_wb((unsigned long)win->block[i].bdesc, 1);

		set_memory_wb((unsigned long)win->block[i].bdesc, 1);

#endif

#endif

		dma_free_coherent(msc_dev(win->msc), PAGE_SIZE,

		dma_free_coherent(msc_dev(win->msc)->parent->parent, PAGE_SIZE,

				  win->block[i].bdesc, win->block[i].addr);

				  win->block[i].bdesc, win->block[i].addr);

	}

	}