Jiang Liu b21fe28e46 iommu/vt-d: Fix an off-by-one bug in __domain_mapping() ... commit cc4f14aa170d895c9a43bdb56f62070c8a6da908 upstream. There's an off-by-one bug in function __domain_mapping(), which may trigger the BUG_ON(nr_pages < lvl_pages) when (nr_pages + 1) & superpage_mask == 0 The issue was introduced by commit 9051aa0268 "intel-iommu: Combine domain_pfn_mapping() and domain_sg_mapping()", which sets sg_res to "nr_pages + 1" to avoid some of the 'sg_res==0' code paths. It's safe to remove extra "+1" because sg_res is only used to calculate page size now. Reported-And-Tested-by: Sudeep Dutt <sudeep.dutt@intel.com> Signed-off-by: Jiang Liu <jiang.liu@linux.intel.com> Acked-By: David Woodhouse <David.Woodhouse@intel.com> Signed-off-by: Joerg Roedel <jroedel@suse.de> [lizf: Backported to 3.4: adjust context] Signed-off-by: Zefan Li <lizefan@huawei.com>		2015-04-14 17:33:44 +08:00
..
amd_iommu.c	iommu/amd: Fix cleanup_domain for mass device removal	2014-09-25 11:49:11 +08:00
amd_iommu_init.c	iommu/amd: Initialize device table after dma_ops	2013-03-04 06:06:37 +08:00
amd_iommu_proto.h
amd_iommu_types.h	iommu/amd: Re-enable IOMMU event log interrupt after handling.	2013-06-07 12:49:35 -07:00
amd_iommu_v2.c
dmar.c	iommu/vt-d: Disable translation if already enabled	2014-07-28 07:06:46 -07:00
intel-iommu.c	iommu/vt-d: Fix an off-by-one bug in __domain_mapping()	2015-04-14 17:33:44 +08:00
intr_remapping.c
intr_remapping.h
iommu.c
iova.c
Kconfig
Makefile
msm_iommu.c
msm_iommu_dev.c
omap-iommu-debug.c
omap-iommu.c
omap-iovmm.c
tegra-gart.c
tegra-smmu.c	iommu/tegra: smmu: Fix deadly typo	2012-10-28 10:14:15 -07:00