system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-11-05 18:23:50 +00:00
Code Issues Projects Releases Packages Wiki Activity
linux/drivers
History
Alex Williamson 08336fd218 intel-iommu: fix off-by-one in pagetable freeing 
dma_pte_free_level() has an off-by-one error when checking whether a pte
is completely covered by a range.  Take for example the case of
attempting to free pfn 0x0 - 0x1ff, ie.  512 entries covering the first
2M superpage.

The level_size() is 0x200 and we test:

  static void dma_pte_free_level(...
	...

	if (!(0 > 0 || 0x1ff < 0 + 0x200)) {
		...
	}

Clearly the 2nd test is true, which means we fail to take the branch to
clear and free the pagetable entry.  As a result, we're leaking
pagetables and failing to install new pages over the range.

This was found with a PCI device assigned to a QEMU guest using vfio-pci
without a VGA device present.  The first 1M of guest address space is
mapped with various combinations of 4K pages, but eventually the range
is entirely freed and replaced with a 2M contiguous mapping.
intel-iommu errors out with something like:

  ERROR: DMA PTE for vPFN 0x0 already set (to 5c2b8003 not 849c00083)

In this case 5c2b8003 is the pointer to the previous leaf page that was
neither freed nor cleared and 849c00083 is the superpage entry that
we're trying to replace it with.

Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Joerg Roedel <joro@8bytes.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-01-21 16:19:41 -08:00
..
accessibility
acpi Merge branch 'x86-ras-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2014-01-20 12:10:27 -08:00
amba
ata Merge branch 'for-3.13-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata 2014-01-09 09:08:23 +08:00
atm
auxdisplay
base Revert "kernfs, sysfs, driver-core: implement kernfs_remove_self() and its wrappers" 2014-01-13 14:05:13 -08:00
bcma
block Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k 2014-01-20 09:24:31 -08:00
bluetooth Bluetooth: Add support for Toshiba Bluetooth device [0930:0220] 2013-12-04 11:11:49 -02:00
bus
cdrom
char Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security 2014-01-21 09:06:02 -08:00
clk Merge branch 'for-next' into for-linus 2014-01-20 10:20:14 +01:00
clocksource Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2014-01-20 11:34:26 -08:00
connector
cpufreq intel_pstate: Add X86_FEATURE_APERFMPERF to cpu match parameters. 2014-01-06 22:16:14 +01:00
cpuidle ARM/cpuidle: remove __init tag from Calxeda cpuidle probe function 2013-12-30 11:55:20 +01:00
crypto crypto: ixp4xx - Fix kernel compile error 2014-01-01 14:06:23 +08:00
dca
devfreq
dio
dma Merge branch 'for-next' into for-linus 2014-01-20 10:20:14 +01:00
edac Merge branch 'x86-ras-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2014-01-20 12:10:27 -08:00
eisa
extcon extcon: gpio: Add power resume support 2014-01-09 09:53:30 +09:00
firewire firewire: sbp2: bring back WRITE SAME support 2013-12-15 16:32:32 +01:00
firmware Driver core / sysfs patches for 3.14-rc1 2014-01-20 15:49:44 -08:00
fmc
gpio MFD changes due for the v3.14 merge window 2014-01-21 10:58:17 -08:00
gpu drm/nouveau/mxm: fix null deref on load 2014-01-19 18:28:30 -08:00
hid Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid 2013-12-13 13:21:28 -08:00
hsi
hv drivers: hv: Mark the function hv_synic_free_cpu() as static in hv.c 2013-12-18 16:41:52 -08:00
hwmon hwmon: (k10temp) Add support for Kaveri CPUs 2014-01-14 21:36:54 -08:00
hwspinlock
i2c i2c: s3c2410: fix quirk usage for 64-bit 2014-01-16 11:18:24 +01:00
ide
idle Merge branch 'x86/idle' into sched/core 2014-01-13 17:37:05 +01:00
iio MFD changes due for the v3.14 merge window 2014-01-21 10:58:17 -08:00
infiniband infiniband: make sure the src net is infiniband when create new link 2014-01-03 20:38:56 -05:00
input MFD changes due for the v3.14 merge window 2014-01-21 10:58:17 -08:00
iommu intel-iommu: fix off-by-one in pagetable freeing 2014-01-21 16:19:41 -08:00
ipack
irqchip Renesas ARM based SoC fixes for v3.13 2013-12-20 11:28:30 -08:00
isdn isdn: Drop big endian cpp checks from telespci and hfc_pci drivers 2014-01-06 15:50:51 -05:00
leds GPIO tree bulk changes for v3.14 2014-01-21 10:09:12 -08:00
lguest
macintosh Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k 2014-01-20 09:24:31 -08:00
mailbox
md Driver core / sysfs patches for 3.14-rc1 2014-01-20 15:49:44 -08:00
media [media] videobuf2-dma-sg: fix possible memory leak 2013-12-10 05:40:57 -02:00
memory
memstick
message
mfd MFD changes due for the v3.14 merge window 2014-01-21 10:58:17 -08:00
misc Driver core / sysfs patches for 3.14-rc1 2014-01-20 15:49:44 -08:00
mmc ARM: s3c24xx: explicit dependency on <plat/gpio-cfg.h> 2014-01-14 15:24:54 +01:00
mtd Merge branch 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm 2014-01-06 12:20:45 +11:00
net Merge branch 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2014-01-20 10:25:12 -08:00
nfc
ntb
nubus
of Merge remote-tracking branch 'grant/devicetree/merge' into dt-fixes 2013-12-30 12:09:47 -06:00
oprofile
parisc
parport TTY/Serial driver patches for 3.14-rc1 2014-01-20 16:05:23 -08:00
pci Revert "pci: use device_remove_file_self() instead of device_schedule_callback()" 2014-01-13 14:03:06 -08:00
pcmcia pcmcia: Remove superfluous name casts 2013-12-08 22:47:13 -08:00
phy USB patches for 3.14-rc1 2014-01-20 16:13:02 -08:00
pinctrl MFD changes due for the v3.14 merge window 2014-01-21 10:58:17 -08:00
platform
pnp PNP: fix restoring devices after hibernation 2013-12-05 02:01:55 +01:00
power max17042_battery: Add IRQF_ONESHOT flag to use default irq handler 2013-12-23 18:59:41 -08:00
powercap powercap / RAPL: add support for ValleyView Soc 2013-12-22 01:27:51 +01:00
pps
ps3
ptp
pwm pwm: Add LP3943 PWM driver 2014-01-21 08:28:00 +00:00
rapidio
regulator mfd: mc13xxx: Remove useless symbol MFD_MC13783 2014-01-21 08:28:09 +00:00
remoteproc
reset
rpmsg
rtc Merge branch 'fortglx/3.14/time' of git://git.linaro.org/people/john.stultz/linux into timers/core 2014-01-12 14:13:31 +01:00
s390 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux 2014-01-20 09:23:31 -08:00
sbus
scsi Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k 2014-01-20 09:24:31 -08:00
sfi
sh
sn
spi Merge remote-tracking branches 'asoc/topic/ad1836', 'asoc/topic/ad193x', 'asoc/topic/adav80x', 'asoc/topic/adsp', 'asoc/topic/ak4641', 'asoc/topic/ak4642', 'asoc/topic/arizona', 'asoc/topic/atmel', 'asoc/topic/au1x', 'asoc/topic/axi', 'asoc/topic/bcm2835', 'asoc/topic/blackfin', 'asoc/topic/cs4271', 'asoc/topic/cs42l52', 'asoc/topic/da7210', 'asoc/topic/davinci', 'asoc/topic/ep93xx', 'asoc/topic/fsl', 'asoc/topic/fsl-mxs', 'asoc/topic/generic', 'asoc/topic/hdmi', 'asoc/topic/jack', 'asoc/topic/jz4740', 'asoc/topic/max98090', 'asoc/topic/mxs', 'asoc/topic/omap', 'asoc/topic/pxa', 'asoc/topic/rcar', 'asoc/topic/s6000', 'asoc/topic/sai', 'asoc/topic/samsung', 'asoc/topic/sgtl5000', 'asoc/topic/spear', 'asoc/topic/ssm2518', 'asoc/topic/ssm2602', 'asoc/topic/tegra', 'asoc/topic/tlv320aic3x', 'asoc/topic/twl6040', 'asoc/topic/txx9', 'asoc/topic/uda1380', 'asoc/topic/width', 'asoc/topic/wm8510', 'asoc/topic/wm8523', 'asoc/topic/wm8580', 'asoc/topic/wm8711', 'asoc/topic/wm8728', 'asoc/topic/wm8731', 'asoc/topic/wm8741', 'asoc/topic/wm8750', 'asoc/topic/wm8753', 'asoc/topic/wm8776', 'asoc/topic/wm8804', 'asoc/topic/wm8900', 'asoc/topic/wm8901', 'asoc/topic/wm8940', 'asoc/topic/wm8962', 'asoc/topic/wm8974', 'asoc/topic/wm8985', 'asoc/topic/wm8988', 'asoc/topic/wm8990', 'asoc/topic/wm8991', 'asoc/topic/wm8994', 'asoc/topic/wm8995', 'asoc/topic/wm9081' and 'asoc/topic/x86' into asoc-next 2014-01-02 13:01:55 +00:00
ssb
staging USB patches for 3.14-rc1 2014-01-20 16:13:02 -08:00
target target: Remove extra percpu_ref_init 2013-12-19 14:49:54 -08:00
tc
thermal sched, thermal: Clean up preempt_enable_no_resched() abuse 2014-01-13 17:39:18 +01:00
tty tty/serial: at91: disable uart timer at start of shutdown 2014-01-13 15:55:59 -08:00
uio uio: fix devm_request_irq usage 2013-12-20 08:49:17 -08:00
usb USB patches for 3.14-rc1 2014-01-20 16:13:02 -08:00
uwb uwb: move mutex_lock to error case in uwbd_evt_handle_rc_bp_slot_change 2013-12-20 12:19:44 -08:00
vfio
vhost
video Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k 2014-01-20 09:24:31 -08:00
virt
virtio virtio_balloon: update_balloon_size(): update correct field 2013-12-05 13:12:39 +10:30
vlynq
vme vme: Convert VME core to register as a subsystem 2013-12-17 17:06:19 -08:00
w1 w1: mxc_w1: Check the clk_prepare_enable() return value 2013-12-08 22:41:48 -08:00
watchdog Watchdog: pcwd_usb: remove CONFIG_USB_DEBUG usage 2014-01-07 16:15:39 -08:00
xen Bug-fixes: 2013-12-20 09:34:54 -08:00
zorro
Kconfig
Makefile