]> git.hungrycats.org Git - linux/commit
iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables
authorMostafa Saleh <smostafa@google.com>
Thu, 24 Oct 2024 16:25:15 +0000 (16:25 +0000)
committerWill Deacon <will@kernel.org>
Tue, 29 Oct 2024 15:27:57 +0000 (15:27 +0000)
commitd71fa842d33c48ac2809ae11d2379b5a788792cb
treef77871faef25c4f55e70488ab7fb5805e681b0cf
parent89edbe88db2857880b08ce363a2695eec657f51b
iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables

ARM_LPAE_LVL_IDX() takes into account concatenated PGDs and can return
an index spanning multiple page-table pages given a sufficiently large
input address. However, when the resulting index is used to calculate
the number of remaining entries in the page, the possibility of
concatenation is ignored and we end up computing a negative upper bound:

max_entries = ARM_LPAE_PTES_PER_TABLE(data) - map_idx_start;

On the map path, this results in a negative 'mapped' value being
returned but on the unmap path we can leak child tables if they are
skipped in __arm_lpae_free_pgtable().

Introduce an arm_lpae_max_entries() helper to convert a table index into
the remaining number of entries within a single page-table page.

Cc: <stable@vger.kernel.org>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Link: https://lore.kernel.org/r/20241024162516.2005652-2-smostafa@google.com
[will: Tweaked comment and commit message]
Signed-off-by: Will Deacon <will@kernel.org>
drivers/iommu/io-pgtable-arm.c