releases/4.16.14/intel_th-use-correct-device-when-freeing-buffers.patch

   1 From 0ed2424b911f3a058dfea01b78817abed767433d Mon Sep 17 00:00:00 2001
   2 From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
   3 Date: Thu, 24 May 2018 11:27:27 +0300
   4 Subject: intel_th: Use correct device when freeing buffers
   5
   6 From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
   7
   8 commit 0ed2424b911f3a058dfea01b78817abed767433d upstream.
   9
  10 Commit d5c435df4a890 ("intel_th: msu: Use the real device in case of IOMMU
  11 domain allocation") changes dma buffer allocation to use the actual
  12 underlying device, but forgets to change the deallocation path, which leads
  13 to (if you've got CAP_SYS_RAWIO):
  14
  15 > # echo 0,0 > /sys/bus/intel_th/devices/0-msc0/nr_pages
  16 > ------------[ cut here ]------------
  17 > kernel BUG at ../linux/drivers/iommu/intel-iommu.c:3670!
  18 > CPU: 3 PID: 231 Comm: sh Not tainted 4.17.0-rc1+ #2729
  19 > RIP: 0010:intel_unmap+0x11e/0x130
  20 ...
  21 > Call Trace:
  22 >  intel_free_coherent+0x3e/0x60
  23 >  msc_buffer_win_free+0x100/0x160 [intel_th_msu]
  24
  25 This patch fixes the buffer deallocation code to use the correct device.
  26
  27 Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
  28 Fixes: d5c435df4a890 ("intel_th: msu: Use the real device in case of IOMMU domain allocation")
  29 Reported-by: Baofeng Tian <baofeng.tian@intel.com>
  30 CC: stable@vger.kernel.org # v4.14+
  31 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  32
  33 ---
  34  drivers/hwtracing/intel_th/msu.c |    6 +++---
  35  1 file changed, 3 insertions(+), 3 deletions(-)
  36
  37 --- a/drivers/hwtracing/intel_th/msu.c
  38 +++ b/drivers/hwtracing/intel_th/msu.c
  39 @@ -741,8 +741,8 @@ err_nomem:
  40                 /* Reset the page to write-back before releasing */
  41                 set_memory_wb((unsigned long)win->block[i].bdesc, 1);
  42  #endif
  43 -               dma_free_coherent(msc_dev(msc), size, win->block[i].bdesc,
  44 -                                 win->block[i].addr);
  45 +               dma_free_coherent(msc_dev(msc)->parent->parent, size,
  46 +                                 win->block[i].bdesc, win->block[i].addr);
  47         }
  48         kfree(win);
  49
  50 @@ -777,7 +777,7 @@ static void msc_buffer_win_free(struct m
  51                 /* Reset the page to write-back before releasing */
  52                 set_memory_wb((unsigned long)win->block[i].bdesc, 1);
  53  #endif
  54 -               dma_free_coherent(msc_dev(win->msc), PAGE_SIZE,
  55 +               dma_free_coherent(msc_dev(win->msc)->parent->parent, PAGE_SIZE,
  56                                   win->block[i].bdesc, win->block[i].addr);
  57         }
  58