summaryrefslogtreecommitdiff
path: root/drivers/iommu
diff options
context:
space:
mode:
authorRobin Murphy <robin.murphy@arm.com>2017-09-19 14:48:40 +0100
committerJoerg Roedel <jroedel@suse.de>2017-09-28 14:57:15 +0200
commitb826ee9a4f1cbf83cadc5a307de8eea27637699a (patch)
tree6d847b28d7d22ec08e56d2e14b9bbda1e9fead1f /drivers/iommu
parent7595dc588a39c37091ddf65f6c0a3cd40f128e7a (diff)
iommu/iova: Make rcache limit_pfn handling more robust
When popping a pfn from an rcache, we are currently checking it directly against limit_pfn for viability. Since this represents iova->pfn_lo, it is technically possible for the corresponding iova->pfn_hi to be greater than limit_pfn. Although we generally get away with it in practice since limit_pfn is typically a power-of-two boundary and the IOVAs are size-aligned, it's pretty trivial to make the iova_rcache_get() path take the allocation size into account for complete safety. Signed-off-by: Robin Murphy <robin.murphy@arm.com> Signed-off-by: Joerg Roedel <jroedel@suse.de>
Diffstat (limited to 'drivers/iommu')
-rw-r--r--drivers/iommu/iova.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c
index ca21196c1f2d..15ff3033bbd7 100644
--- a/drivers/iommu/iova.c
+++ b/drivers/iommu/iova.c
@@ -406,7 +406,7 @@ alloc_iova_fast(struct iova_domain *iovad, unsigned long size,
unsigned long iova_pfn;
struct iova *new_iova;
- iova_pfn = iova_rcache_get(iovad, size, limit_pfn);
+ iova_pfn = iova_rcache_get(iovad, size, limit_pfn + 1);
if (iova_pfn)
return iova_pfn;
@@ -823,7 +823,7 @@ static unsigned long iova_magazine_pop(struct iova_magazine *mag,
{
BUG_ON(iova_magazine_empty(mag));
- if (mag->pfns[mag->size - 1] >= limit_pfn)
+ if (mag->pfns[mag->size - 1] > limit_pfn)
return 0;
return mag->pfns[--mag->size];
@@ -977,7 +977,7 @@ static unsigned long iova_rcache_get(struct iova_domain *iovad,
if (log_size >= IOVA_RANGE_CACHE_MAX_SIZE)
return 0;
- return __iova_rcache_get(&iovad->rcaches[log_size], limit_pfn);
+ return __iova_rcache_get(&iovad->rcaches[log_size], limit_pfn - size);
}
/*