Alex Williamson
08336fd218
intel-iommu: fix off-by-one in pagetable freeing ...
dma_pte_free_level() has an off-by-one error when checking whether a pte
is completely covered by a range. Take for example the case of
attempting to free pfn 0x0 - 0x1ff, ie. 512 entries covering the first
2M superpage.
The level_size() is 0x200 and we test:
static void dma_pte_free_level(...
...
if (!(0 > 0 || 0x1ff < 0 + 0x200)) {
...
}
Clearly the 2nd test is true, which means we fail to take the branch to
clear and free the pagetable entry. As a result, we're leaking
pagetables and failing to install new pages over the range.
This was found with a PCI device assigned to a QEMU guest using vfio-pci
without a VGA device present. The first 1M of guest address space is
mapped with various combinations of 4K pages, but eventually the range
is entirely freed and replaced with a 2M contiguous mapping.
intel-iommu errors out with something like:
ERROR: DMA PTE for vPFN 0x0 already set (to 5c2b8003 not 849c00083)
In this case 5c2b8003 is the pointer to the previous leaf page that was
neither freed nor cleared and 849c00083 is the superpage entry that
we're trying to replace it with.
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Joerg Roedel <joro@8bytes.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-01-21 16:19:41 -08:00
Merge branch 'x86-ras-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-01-20 12:10:27 -08:00
Merge branch 'for-3.13-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata
2014-01-09 09:08:23 +08:00
Revert "kernfs, sysfs, driver-core: implement kernfs_remove_self() and its wrappers"
2014-01-13 14:05:13 -08:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k
2014-01-20 09:24:31 -08:00
Bluetooth: Add support for Toshiba Bluetooth device [0930:0220]
2013-12-04 11:11:49 -02:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2014-01-21 09:06:02 -08:00
Merge branch 'for-next' into for-linus
2014-01-20 10:20:14 +01:00
Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-01-20 11:34:26 -08:00
intel_pstate: Add X86_FEATURE_APERFMPERF to cpu match parameters.
2014-01-06 22:16:14 +01:00
ARM/cpuidle: remove __init tag from Calxeda cpuidle probe function
2013-12-30 11:55:20 +01:00
crypto: ixp4xx - Fix kernel compile error
2014-01-01 14:06:23 +08:00
Merge branch 'for-next' into for-linus
2014-01-20 10:20:14 +01:00
Merge branch 'x86-ras-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-01-20 12:10:27 -08:00
extcon: gpio: Add power resume support
2014-01-09 09:53:30 +09:00
firewire: sbp2: bring back WRITE SAME support
2013-12-15 16:32:32 +01:00
Driver core / sysfs patches for 3.14-rc1
2014-01-20 15:49:44 -08:00
MFD changes due for the v3.14 merge window
2014-01-21 10:58:17 -08:00
drm/nouveau/mxm: fix null deref on load
2014-01-19 18:28:30 -08:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid
2013-12-13 13:21:28 -08:00
drivers: hv: Mark the function hv_synic_free_cpu() as static in hv.c
2013-12-18 16:41:52 -08:00
hwmon: (k10temp) Add support for Kaveri CPUs
2014-01-14 21:36:54 -08:00
i2c: s3c2410: fix quirk usage for 64-bit
2014-01-16 11:18:24 +01:00
Merge branch 'x86/idle' into sched/core
2014-01-13 17:37:05 +01:00
MFD changes due for the v3.14 merge window
2014-01-21 10:58:17 -08:00
infiniband: make sure the src net is infiniband when create new link
2014-01-03 20:38:56 -05:00
MFD changes due for the v3.14 merge window
2014-01-21 10:58:17 -08:00
intel-iommu: fix off-by-one in pagetable freeing
2014-01-21 16:19:41 -08:00
Renesas ARM based SoC fixes for v3.13
2013-12-20 11:28:30 -08:00
isdn: Drop big endian cpp checks from telespci and hfc_pci drivers
2014-01-06 15:50:51 -05:00
GPIO tree bulk changes for v3.14
2014-01-21 10:09:12 -08:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k
2014-01-20 09:24:31 -08:00
Driver core / sysfs patches for 3.14-rc1
2014-01-20 15:49:44 -08:00
[media] videobuf2-dma-sg: fix possible memory leak
2013-12-10 05:40:57 -02:00
MFD changes due for the v3.14 merge window
2014-01-21 10:58:17 -08:00
Driver core / sysfs patches for 3.14-rc1
2014-01-20 15:49:44 -08:00
ARM: s3c24xx: explicit dependency on <plat/gpio-cfg.h>
2014-01-14 15:24:54 +01:00
Merge branch 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm
2014-01-06 12:20:45 +11:00
Merge branch 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-01-20 10:25:12 -08:00
Merge remote-tracking branch 'grant/devicetree/merge' into dt-fixes
2013-12-30 12:09:47 -06:00
TTY/Serial driver patches for 3.14-rc1
2014-01-20 16:05:23 -08:00
Revert "pci: use device_remove_file_self() instead of device_schedule_callback()"
2014-01-13 14:03:06 -08:00
pcmcia: Remove superfluous name casts
2013-12-08 22:47:13 -08:00
USB patches for 3.14-rc1
2014-01-20 16:13:02 -08:00
MFD changes due for the v3.14 merge window
2014-01-21 10:58:17 -08:00
PNP: fix restoring devices after hibernation
2013-12-05 02:01:55 +01:00
max17042_battery: Add IRQF_ONESHOT flag to use default irq handler
2013-12-23 18:59:41 -08:00
powercap / RAPL: add support for ValleyView Soc
2013-12-22 01:27:51 +01:00
pwm: Add LP3943 PWM driver
2014-01-21 08:28:00 +00:00
mfd: mc13xxx: Remove useless symbol MFD_MC13783
2014-01-21 08:28:09 +00:00
Merge branch 'fortglx/3.14/time' of git://git.linaro.org/people/john.stultz/linux into timers/core
2014-01-12 14:13:31 +01:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
2014-01-20 09:23:31 -08:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k
2014-01-20 09:24:31 -08:00
Merge remote-tracking branches 'asoc/topic/ad1836', 'asoc/topic/ad193x', 'asoc/topic/adav80x', 'asoc/topic/adsp', 'asoc/topic/ak4641', 'asoc/topic/ak4642', 'asoc/topic/arizona', 'asoc/topic/atmel', 'asoc/topic/au1x', 'asoc/topic/axi', 'asoc/topic/bcm2835', 'asoc/topic/blackfin', 'asoc/topic/cs4271', 'asoc/topic/cs42l52', 'asoc/topic/da7210', 'asoc/topic/davinci', 'asoc/topic/ep93xx', 'asoc/topic/fsl', 'asoc/topic/fsl-mxs', 'asoc/topic/generic', 'asoc/topic/hdmi', 'asoc/topic/jack', 'asoc/topic/jz4740', 'asoc/topic/max98090', 'asoc/topic/mxs', 'asoc/topic/omap', 'asoc/topic/pxa', 'asoc/topic/rcar', 'asoc/topic/s6000', 'asoc/topic/sai', 'asoc/topic/samsung', 'asoc/topic/sgtl5000', 'asoc/topic/spear', 'asoc/topic/ssm2518', 'asoc/topic/ssm2602', 'asoc/topic/tegra', 'asoc/topic/tlv320aic3x', 'asoc/topic/twl6040', 'asoc/topic/txx9', 'asoc/topic/uda1380', 'asoc/topic/width', 'asoc/topic/wm8510', 'asoc/topic/wm8523', 'asoc/topic/wm8580', 'asoc/topic/wm8711', 'asoc/topic/wm8728', 'asoc/topic/wm8731', 'asoc/topic/wm8741', 'asoc/topic/wm8750', 'asoc/topic/wm8753', 'asoc/topic/wm8776', 'asoc/topic/wm8804', 'asoc/topic/wm8900', 'asoc/topic/wm8901', 'asoc/topic/wm8940', 'asoc/topic/wm8962', 'asoc/topic/wm8974', 'asoc/topic/wm8985', 'asoc/topic/wm8988', 'asoc/topic/wm8990', 'asoc/topic/wm8991', 'asoc/topic/wm8994', 'asoc/topic/wm8995', 'asoc/topic/wm9081' and 'asoc/topic/x86' into asoc-next
2014-01-02 13:01:55 +00:00
USB patches for 3.14-rc1
2014-01-20 16:13:02 -08:00
target: Remove extra percpu_ref_init
2013-12-19 14:49:54 -08:00
sched, thermal: Clean up preempt_enable_no_resched() abuse
2014-01-13 17:39:18 +01:00
tty/serial: at91: disable uart timer at start of shutdown
2014-01-13 15:55:59 -08:00
uio: fix devm_request_irq usage
2013-12-20 08:49:17 -08:00
USB patches for 3.14-rc1
2014-01-20 16:13:02 -08:00
uwb: move mutex_lock to error case in uwbd_evt_handle_rc_bp_slot_change
2013-12-20 12:19:44 -08:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k
2014-01-20 09:24:31 -08:00
virtio_balloon: update_balloon_size(): update correct field
2013-12-05 13:12:39 +10:30
vme: Convert VME core to register as a subsystem
2013-12-17 17:06:19 -08:00
w1: mxc_w1: Check the clk_prepare_enable() return value
2013-12-08 22:41:48 -08:00
Watchdog: pcwd_usb: remove CONFIG_USB_DEBUG usage
2014-01-07 16:15:39 -08:00
Bug-fixes:
2013-12-20 09:34:54 -08:00
08336fd218