vfio iommu type1: Fix size argument to vfio_find_dma() in pin_pages/unpin_pages

Passing zero for the size to vfio_find_dma() isn't compatible with matching the start address of an existing vfio_dma. Doing so triggers a corner case. In vfio_find_dma(), when the start address is equal to dma->iova and size is 0, check for the end of search range makes it to take wrong side of RB-tree. That fails the search even though the address is present in mapped dma ranges. In functions pin_pages and unpin_pages, the iova which is being searched is base address of page to be pinned or unpinned. So here size should be set to PAGE_SIZE, as argument to vfio_find_dma().

Kirti Wankhede committed 9 years ago

Commit 2b8bb1d1 parent 7c03f421 file · +3 −3Browse files

Unified · Split

drivers/vfio/vfio_iommu_type1.c+3−3

@@ -581,7 +581,7 @@ static int vfio_iommu_type1_pin_pages(void *iommu_data, · 580 unmodified lines
581	struct vfio_pfn *vpfn;	581	struct vfio_pfn *vpfn;
582		582
583	iova = user_pfn[i] << PAGE_SHIFT;	583	iova = user_pfn[i] << PAGE_SHIFT;
584	dma = vfio_find_dma(iommu, iova, 0);	584	dma = vfio_find_dma(iommu, iova, PAGE_SIZE);
585	if (!dma) {	585	if (!dma) {
586	ret = -EINVAL;	586	ret = -EINVAL;
587	goto pin_unwind;	587	goto pin_unwind;
@@ -622,7 +622,7 @@ pin_unwind: · 34 unmodified lines
622	dma_addr_t iova;	622	dma_addr_t iova;
623		623
624	iova = user_pfn[j] << PAGE_SHIFT;	624	iova = user_pfn[j] << PAGE_SHIFT;
625	dma = vfio_find_dma(iommu, iova, 0);	625	dma = vfio_find_dma(iommu, iova, PAGE_SIZE);
626	vfio_unpin_page_external(dma, iova, do_accounting);	626	vfio_unpin_page_external(dma, iova, do_accounting);
627	phys_pfn[j] = 0;	627	phys_pfn[j] = 0;
628	}	628	}
@@ -659,7 +659,7 @@ static int vfio_iommu_type1_unpin_pages(void *iommu_data, · 30 unmodified lines
659	dma_addr_t iova;	659	dma_addr_t iova;
660		660
661	iova = user_pfn[i] << PAGE_SHIFT;	661	iova = user_pfn[i] << PAGE_SHIFT;
662	dma = vfio_find_dma(iommu, iova, 0);	662	dma = vfio_find_dma(iommu, iova, PAGE_SIZE);
663	if (!dma)	663	if (!dma)
664	goto unpin_exit;	664	goto unpin_exit;
665	vfio_unpin_page_external(dma, iova, do_accounting);	665	vfio_unpin_page_external(dma, iova, do_accounting);