Commit 31d3568d authored by Fenghua Yu's avatar Fenghua Yu Committed by David Woodhouse

Intel-IOMMU Alignment Issue in dma_pte_clear_range()

This issue was pointed out by Linus.

In dma_pte_clear_range() in intel-iommu.c

start = PAGE_ALIGN(start);
end &= PAGE_MASK;
npages = (end - start) / VTD_PAGE_SIZE;

In partial page case, start could be bigger than end and npages will be
negative.

Currently the issue doesn't show up as a real bug in because start and 
end have been aligned to page boundary already by all callers. So the 
issue has been hidden. But it is dangerous programming practice.
Signed-off-by: default avatarFenghua Yu <fenghua.yu@intel.com>
Signed-off-by: default avatarDavid Woodhouse <David.Woodhouse@intel.com>
parent ffa009c3
...@@ -733,8 +733,8 @@ static void dma_pte_clear_range(struct dmar_domain *domain, u64 start, u64 end) ...@@ -733,8 +733,8 @@ static void dma_pte_clear_range(struct dmar_domain *domain, u64 start, u64 end)
start &= (((u64)1) << addr_width) - 1; start &= (((u64)1) << addr_width) - 1;
end &= (((u64)1) << addr_width) - 1; end &= (((u64)1) << addr_width) - 1;
/* in case it's partial page */ /* in case it's partial page */
start = PAGE_ALIGN(start); start &= PAGE_MASK;
end &= PAGE_MASK; end = PAGE_ALIGN(end);
npages = (end - start) / VTD_PAGE_SIZE; npages = (end - start) / VTD_PAGE_SIZE;
/* we don't need lock here, nobody else touches the iova range */ /* we don't need lock here, nobody else touches the iova range */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment