From patchwork Wed Feb 10 15:08:44 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sasha Levin X-Patchwork-Id: 61671 Delivered-To: patch@linaro.org Received: by 10.112.43.199 with SMTP id y7csp2700929lbl; Wed, 10 Feb 2016 07:13:25 -0800 (PST) X-Received: by 10.66.180.174 with SMTP id dp14mr47613938pac.93.1455117176535; Wed, 10 Feb 2016 07:12:56 -0800 (PST) Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id gj3si5562271pac.243.2016.02.10.07.12.56; Wed, 10 Feb 2016 07:12:56 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752799AbcBJPMt (ORCPT + 3 others); Wed, 10 Feb 2016 10:12:49 -0500 Received: from userp1040.oracle.com ([156.151.31.81]:46026 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752636AbcBJPMq (ORCPT ); Wed, 10 Feb 2016 10:12:46 -0500 Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id u1AFCeen023001 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 10 Feb 2016 15:12:40 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userv0021.oracle.com (8.13.8/8.13.8) with ESMTP id u1AFCeiP003180 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Wed, 10 Feb 2016 15:12:40 GMT Received: from abhmp0006.oracle.com (abhmp0006.oracle.com [141.146.116.12]) by aserv0121.oracle.com (8.13.8/8.13.8) with ESMTP id u1AFCeiY030487; Wed, 10 Feb 2016 15:12:40 GMT Received: from lappy.us.oracle.com (/10.154.137.179) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 10 Feb 2016 07:12:39 -0800 From: Sasha Levin To: stable@vger.kernel.org, stable-commits@vger.kernel.org Cc: Will Deacon , Sasha Levin Subject: [added to the 4.1 stable tree] iommu/io-pgtable-arm: Ensure we free the final level on teardown Date: Wed, 10 Feb 2016 10:08:44 -0500 Message-Id: <1455117136-28870-20-git-send-email-sasha.levin@oracle.com> X-Mailer: git-send-email 2.5.0 In-Reply-To: <1455117136-28870-1-git-send-email-sasha.levin@oracle.com> References: <1455117136-28870-1-git-send-email-sasha.levin@oracle.com> X-Source-IP: userv0021.oracle.com [156.151.31.71] Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Will Deacon This patch has been added to the 4.1 stable tree. If you have any objections, please let us know. -- 2.5.0 -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html =============== [ Upstream commit 12c2ab09571e8aae3a87da2a4a452632a5fac1e5 ] When tearing down page tables, we return early for the final level since we know that we won't have any table pointers to follow. Unfortunately, this also means that we forget to free the final level, so we end up leaking memory. Fix the issue by always freeing the current level, but just don't bother to iterate over the ptes if we're at the final level. Cc: Reported-by: Zhang Bo Signed-off-by: Will Deacon Signed-off-by: Sasha Levin --- drivers/iommu/io-pgtable-arm.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c index e29d5d7..937832c 100644 --- a/drivers/iommu/io-pgtable-arm.c +++ b/drivers/iommu/io-pgtable-arm.c @@ -341,17 +341,18 @@ static void __arm_lpae_free_pgtable(struct arm_lpae_io_pgtable *data, int lvl, arm_lpae_iopte *start, *end; unsigned long table_size; - /* Only leaf entries at the last level */ - if (lvl == ARM_LPAE_MAX_LEVELS - 1) - return; - if (lvl == ARM_LPAE_START_LVL(data)) table_size = data->pgd_size; else table_size = 1UL << data->pg_shift; start = ptep; - end = (void *)ptep + table_size; + + /* Only leaf entries at the last level */ + if (lvl == ARM_LPAE_MAX_LEVELS - 1) + end = ptep; + else + end = (void *)ptep + table_size; while (ptep != end) { arm_lpae_iopte pte = *ptep++;