Passing zero for the size to vfio_find_dma() isn't compatible with matching the start address of an existing vfio_dma. Doing so triggers a corner case. In vfio_find_dma(), when the start address is equal to dma->iova and size is 0, check for the end of search range makes it to take wrong side of RB-tree. That fails the search even though the address is present in mapped dma ranges. In functions pin_pages and unpin_pages, the iova which is being searched is base address of page to be pinned or unpinned. So here size should be set to PAGE_SIZE, as argument to vfio_find_dma().
Unified · Split
| @@ -581,7 +581,7 @@ static int vfio_iommu_type1_pin_pages(void *iommu_data, · 580 unmodified lines | ||
| 581 | 581 | struct vfio_pfn *vpfn; |
| 582 | 582 | |
| 583 | 583 | iova = user_pfn[i] << PAGE_SHIFT; |
| 584 | − dma = vfio_find_dma(iommu, iova, 0); | |
| 584 | + dma = vfio_find_dma(iommu, iova, PAGE_SIZE); | |
| 585 | 585 | if (!dma) { |
| 586 | 586 | ret = -EINVAL; |
| 587 | 587 | goto pin_unwind; |
| @@ -622,7 +622,7 @@ pin_unwind: · 34 unmodified lines | ||
| 622 | 622 | dma_addr_t iova; |
| 623 | 623 | |
| 624 | 624 | iova = user_pfn[j] << PAGE_SHIFT; |
| 625 | − dma = vfio_find_dma(iommu, iova, 0); | |
| 625 | + dma = vfio_find_dma(iommu, iova, PAGE_SIZE); | |
| 626 | 626 | vfio_unpin_page_external(dma, iova, do_accounting); |
| 627 | 627 | phys_pfn[j] = 0; |
| 628 | 628 | } |
| @@ -659,7 +659,7 @@ static int vfio_iommu_type1_unpin_pages(void *iommu_data, · 30 unmodified lines | ||
| 659 | 659 | dma_addr_t iova; |
| 660 | 660 | |
| 661 | 661 | iova = user_pfn[i] << PAGE_SHIFT; |
| 662 | − dma = vfio_find_dma(iommu, iova, 0); | |
| 662 | + dma = vfio_find_dma(iommu, iova, PAGE_SIZE); | |
| 663 | 663 | if (!dma) |
| 664 | 664 | goto unpin_exit; |
| 665 | 665 | vfio_unpin_page_external(dma, iova, do_accounting); |