Skip to content

Commit 2b8bb1d

Browse files
Kirti WankhedeAlex Williamson
authored andcommitted
vfio iommu type1: Fix size argument to vfio_find_dma() in pin_pages/unpin_pages
Passing zero for the size to vfio_find_dma() isn't compatible with matching the start address of an existing vfio_dma. Doing so triggers a corner case. In vfio_find_dma(), when the start address is equal to dma->iova and size is 0, check for the end of search range makes it to take wrong side of RB-tree. That fails the search even though the address is present in mapped dma ranges. In functions pin_pages and unpin_pages, the iova which is being searched is base address of page to be pinned or unpinned. So here size should be set to PAGE_SIZE, as argument to vfio_find_dma(). Signed-off-by: Kirti Wankhede <kwankhede@nvidia.com> Signed-off-by: Neo Jia <cjia@nvidia.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
1 parent 7c03f42 commit 2b8bb1d

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

drivers/vfio/vfio_iommu_type1.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -581,7 +581,7 @@ static int vfio_iommu_type1_pin_pages(void *iommu_data,
581581
struct vfio_pfn *vpfn;
582582

583583
iova = user_pfn[i] << PAGE_SHIFT;
584-
dma = vfio_find_dma(iommu, iova, 0);
584+
dma = vfio_find_dma(iommu, iova, PAGE_SIZE);
585585
if (!dma) {
586586
ret = -EINVAL;
587587
goto pin_unwind;
@@ -622,7 +622,7 @@ static int vfio_iommu_type1_pin_pages(void *iommu_data,
622622
dma_addr_t iova;
623623

624624
iova = user_pfn[j] << PAGE_SHIFT;
625-
dma = vfio_find_dma(iommu, iova, 0);
625+
dma = vfio_find_dma(iommu, iova, PAGE_SIZE);
626626
vfio_unpin_page_external(dma, iova, do_accounting);
627627
phys_pfn[j] = 0;
628628
}
@@ -659,7 +659,7 @@ static int vfio_iommu_type1_unpin_pages(void *iommu_data,
659659
dma_addr_t iova;
660660

661661
iova = user_pfn[i] << PAGE_SHIFT;
662-
dma = vfio_find_dma(iommu, iova, 0);
662+
dma = vfio_find_dma(iommu, iova, PAGE_SIZE);
663663
if (!dma)
664664
goto unpin_exit;
665665
vfio_unpin_page_external(dma, iova, do_accounting);

0 commit comments

Comments
 (0)