UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

intel_th: Use correct device when freeing buffers 

Commit d5c435df4a ("intel_th: msu: Use the real device in case of IOMMU
domain allocation") changes dma buffer allocation to use the actual
underlying device, but forgets to change the deallocation path, which leads
to (if you've got CAP_SYS_RAWIO):

> # echo 0,0 > /sys/bus/intel_th/devices/0-msc0/nr_pages
> ------------[ cut here ]------------
> kernel BUG at ../linux/drivers/iommu/intel-iommu.c:3670!
> CPU: 3 PID: 231 Comm: sh Not tainted 4.17.0-rc1+ #2729
> RIP: 0010:intel_unmap+0x11e/0x130
...
> Call Trace:
>  intel_free_coherent+0x3e/0x60
>  msc_buffer_win_free+0x100/0x160 [intel_th_msu]

This patch fixes the buffer deallocation code to use the correct device.

Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Fixes: d5c435df4a ("intel_th: msu: Use the real device in case of IOMMU domain allocation")
Reported-by: Baofeng Tian <baofeng.tian@intel.com>
CC: stable@vger.kernel.org # v4.14+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Alexander Shishkin 2018-05-24 11:27:27 +03:00 committed by Greg Kroah-Hartman
parent b5e2ced9bf
commit 0ed2424b91
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/hwtracing/intel_th/msu.c
View File

@ -733,8 +733,8 @@ err_nomem:
/* Reset the page to write-back before releasing */ /* Reset the page to write-back before releasing */
set_memory_wb((unsigned long)win->block[i].bdesc, 1); set_memory_wb((unsigned long)win->block[i].bdesc, 1);
#endif #endif
dma_free_coherent(msc_dev(msc), size, win->block[i].bdesc, dma_free_coherent(msc_dev(msc)->parent->parent, size,
win->block[i].addr); win->block[i].bdesc, win->block[i].addr);
} }
kfree(win); kfree(win);
@ -769,7 +769,7 @@ static void msc_buffer_win_free(struct msc *msc, struct msc_window *win)
/* Reset the page to write-back before releasing */ /* Reset the page to write-back before releasing */
set_memory_wb((unsigned long)win->block[i].bdesc, 1); set_memory_wb((unsigned long)win->block[i].bdesc, 1);
#endif #endif
dma_free_coherent(msc_dev(win->msc), PAGE_SIZE, dma_free_coherent(msc_dev(win->msc)->parent->parent, PAGE_SIZE,
win->block[i].bdesc, win->block[i].addr); win->block[i].bdesc, win->block[i].addr);
} }